diff mbox series

drm/i915/bios: fix slab-out-of-bounds access

Message ID 20211221130824.1796242-1-jani.nikula@intel.com (mailing list archive)
State New, archived
Headers show
Series drm/i915/bios: fix slab-out-of-bounds access | expand

Commit Message

Jani Nikula Dec. 21, 2021, 1:08 p.m. UTC
If VBT size is not a multiple of 4, the last 4-byte store will be out of
bounds of the allocated buffer. Spotted with KASAN. Round up the
allocation size.

Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller")
Cc: Clint Taylor <clinton.a.taylor@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Thomas Hellström Dec. 21, 2021, 1:35 p.m. UTC | #1
On 12/21/21 14:08, Jani Nikula wrote:
> If VBT size is not a multiple of 4, the last 4-byte store will be out of
> bounds of the allocated buffer. Spotted with KASAN. Round up the
> allocation size.
>
> Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller")
> Cc: Clint Taylor <clinton.a.taylor@intel.com>
> Cc: Lucas De Marchi <lucas.demarchi@intel.com>
> Signed-off-by: Jani Nikula <jani.nikula@intel.com>


> ---
>   drivers/gpu/drm/i915/display/intel_bios.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index 76a8f001f4c4..310609d186cd 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915)
>   	vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER);
>   	vbt_size &= 0xffff;
>   
> -	vbt = kzalloc(vbt_size, GFP_KERNEL);
> +	vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL);

Use round_up since a power of 2?

Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

>   	if (!vbt)
>   		goto err_not_found;
>
Jani Nikula Dec. 22, 2021, 8:27 a.m. UTC | #2
On Tue, 21 Dec 2021, Thomas Hellström <thomas.hellstrom@linux.intel.com> wrote:
> On 12/21/21 14:08, Jani Nikula wrote:
>> If VBT size is not a multiple of 4, the last 4-byte store will be out of
>> bounds of the allocated buffer. Spotted with KASAN. Round up the
>> allocation size.
>>
>> Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller")
>> Cc: Clint Taylor <clinton.a.taylor@intel.com>
>> Cc: Lucas De Marchi <lucas.demarchi@intel.com>
>> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
>
>
>> ---
>>   drivers/gpu/drm/i915/display/intel_bios.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
>> index 76a8f001f4c4..310609d186cd 100644
>> --- a/drivers/gpu/drm/i915/display/intel_bios.c
>> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
>> @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915)
>>   	vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER);
>>   	vbt_size &= 0xffff;
>>   
>> -	vbt = kzalloc(vbt_size, GFP_KERNEL);
>> +	vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL);
>
> Use round_up since a power of 2?

Oh, right, *obviously* the underscored version is for powers of two. :p

v2 sent.

> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

Thanks,
Jani.


>
>>   	if (!vbt)
>>   		goto err_not_found;
>>
diff mbox series

Patch

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 76a8f001f4c4..310609d186cd 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -2369,7 +2369,7 @@  static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915)
 	vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER);
 	vbt_size &= 0xffff;
 
-	vbt = kzalloc(vbt_size, GFP_KERNEL);
+	vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL);
 	if (!vbt)
 		goto err_not_found;