From patchwork Sat Oct 20 20:57:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wenwen Wang X-Patchwork-Id: 10651747 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DE09B13A4 for ; Mon, 22 Oct 2018 07:06:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CFCA32879E for ; Mon, 22 Oct 2018 07:06:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C40C228821; Mon, 22 Oct 2018 07:06:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 777752879E for ; Mon, 22 Oct 2018 07:06:45 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A22F889C1B; Mon, 22 Oct 2018 07:06:21 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mta-p6.oit.umn.edu (mta-p6.oit.umn.edu [134.84.196.206]) by gabe.freedesktop.org (Postfix) with ESMTPS id 005A46E04E for ; Sat, 20 Oct 2018 20:58:05 +0000 (UTC) Received: from localhost (unknown [127.0.0.1]) by mta-p6.oit.umn.edu (Postfix) with ESMTP id 2018295D for ; Sat, 20 Oct 2018 20:58:05 +0000 (UTC) X-Virus-Scanned: amavisd-new at umn.edu Received: from mta-p6.oit.umn.edu ([127.0.0.1]) by localhost (mta-p6.oit.umn.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mLEoNudgJGOD for ; Sat, 20 Oct 2018 15:58:05 -0500 (CDT) Received: from mail-it1-f198.google.com (mail-it1-f198.google.com [209.85.166.198]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta-p6.oit.umn.edu (Postfix) with ESMTPS id EFB09967 for ; Sat, 20 Oct 2018 15:58:04 -0500 (CDT) Received: by mail-it1-f198.google.com with SMTP id v125-v6so7935925ita.7 for ; Sat, 20 Oct 2018 13:58:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=xQ+GmITu1UBL82c2OOxEU+5GVCJZBz0JV2g6rO5syUA=; b=giAE8B2M86KDrKZNyBFLWyyKFKe/xpEZW9qBKSj7G98hQvLwt2DKGtvsnzjO0Xtn3g u/1L3am2QBJBqz5zLlf0lpPZgCo9D9/8wU7yN/8BOvUV8QV3I6rleMg9p1yB+L0CahS0 DN4Fh3qrKpp+VZ+8V02TvK7aNzB1POoeUA3M5lJBt/EVmjx2gqBPnU4kDNW/UwscijGt xpbU7RgmklVAgHTtx5eMbmeDipDyAdrMDPnPkaS5QXWbxYntzamhehR4SKKyz5T+RzBk azUYTrhc7SxVGpQ0yccWkEQoxKJFHiotl9qdvJXVMK9uLcTO3mhUM7fSApnvilXYw3Ww 2PXQ== X-Gm-Message-State: ABuFfoiUNDYdLO4/CpcGrAWWXlltCb+5tHEAEKgABrWwOUypieCvRw1e oHGFs2u6UVXeKyzeYODmNNDnVR0cLPBe1PKjZsQ6YYaK7trnzakuNRulz9YW750U8BqZ+vUPa0Z ahdk9emqidC+9ZQeIAGtVJNvFYmxiCwMt X-Received: by 2002:a24:5214:: with SMTP id d20-v6mr6389624itb.24.1540069083683; Sat, 20 Oct 2018 13:58:03 -0700 (PDT) X-Google-Smtp-Source: ACcGV62McDdBEbGsQGQDfxxccpNobEH5ISnvA8IDkIlyt102VMXir3bxYvMKN/JaS2QaVgIDUx9ecw== X-Received: by 2002:a24:5214:: with SMTP id d20-v6mr6389618itb.24.1540069083499; Sat, 20 Oct 2018 13:58:03 -0700 (PDT) Received: from cs-u-cslp16.cs.umn.edu (cs-u-cslp16.cs.umn.edu. [134.84.121.95]) by smtp.gmail.com with ESMTPSA id l142-v6sm4101910itl.23.2018.10.20.13.58.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 20 Oct 2018 13:58:02 -0700 (PDT) From: Wenwen Wang To: Wenwen Wang Subject: [PATCH] drm/amdgpu: fix a missing-check bug Date: Sat, 20 Oct 2018 15:57:54 -0500 Message-Id: <1540069075-18358-1-git-send-email-wang6495@umn.edu> X-Mailer: git-send-email 2.7.4 X-Mailman-Approved-At: Mon, 22 Oct 2018 07:06:20 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: David Airlie , Kangjie Lu , open list , "open list:RADEON and AMDGPU DRM DRIVERS" , "open list:DRM DRIVERS" , Alex Deucher , Ken Wang , =?utf-8?q?Christian_K=C3=B6nig?= MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP In amdgpu_read_bios_from_rom(), the header of the VBIOS is firstly copied to 'header' from an IO memory region through amdgpu_asic_read_bios_from_rom(). Then the header is checked to see whether it is a valid header. If yes, the whole VBIOS, including the header, is then copied to 'adev->bios'. The problem here is that no check is enforced on the header after the second copy. Given that the device also has the permission to access the IO memory region, it is possible for a malicious device controlled by an attacker to modify the header between these two copies. By doing so, the attacker can supply compromised VBIOS, which can cause undefined behavior of the kernel and introduce potential security issues. This patch rewrites the header in 'adev->bios' using the header acquired in the first copy. Signed-off-by: Wenwen Wang --- drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c index a5df80d..ac701f4 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c @@ -181,6 +181,8 @@ static bool amdgpu_read_bios_from_rom(struct amdgpu_device *adev) /* read complete BIOS */ amdgpu_asic_read_bios_from_rom(adev, adev->bios, len); + memcpy(adev->bios, header, AMD_VBIOS_SIGNATURE_END); + if (!check_atom_bios(adev->bios, len)) { kfree(adev->bios); return false;