| Message ID | 20211221130824.1796242-1-jani.nikula@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/bios: fix slab-out-of-bounds access | expand |
On 12/21/21 14:08, Jani Nikula wrote: > If VBT size is not a multiple of 4, the last 4-byte store will be out of > bounds of the allocated buffer. Spotted with KASAN. Round up the > allocation size. > > Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> > Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller") > Cc: Clint Taylor <clinton.a.taylor@intel.com> > Cc: Lucas De Marchi <lucas.demarchi@intel.com> > Signed-off-by: Jani Nikula <jani.nikula@intel.com> > --- > drivers/gpu/drm/i915/display/intel_bios.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c > index 76a8f001f4c4..310609d186cd 100644 > --- a/drivers/gpu/drm/i915/display/intel_bios.c > +++ b/drivers/gpu/drm/i915/display/intel_bios.c > @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915) > vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER); > vbt_size &= 0xffff; > > - vbt = kzalloc(vbt_size, GFP_KERNEL); > + vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL); Use round_up since a power of 2? Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> > if (!vbt) > goto err_not_found; >
On Tue, 21 Dec 2021, Thomas Hellström <thomas.hellstrom@linux.intel.com> wrote: > On 12/21/21 14:08, Jani Nikula wrote: >> If VBT size is not a multiple of 4, the last 4-byte store will be out of >> bounds of the allocated buffer. Spotted with KASAN. Round up the >> allocation size. >> >> Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> >> Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller") >> Cc: Clint Taylor <clinton.a.taylor@intel.com> >> Cc: Lucas De Marchi <lucas.demarchi@intel.com> >> Signed-off-by: Jani Nikula <jani.nikula@intel.com> > > >> --- >> drivers/gpu/drm/i915/display/intel_bios.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c >> index 76a8f001f4c4..310609d186cd 100644 >> --- a/drivers/gpu/drm/i915/display/intel_bios.c >> +++ b/drivers/gpu/drm/i915/display/intel_bios.c >> @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915) >> vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER); >> vbt_size &= 0xffff; >> >> - vbt = kzalloc(vbt_size, GFP_KERNEL); >> + vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL); > > Use round_up since a power of 2? Oh, right, *obviously* the underscored version is for powers of two. :p v2 sent. > Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Thanks, Jani. > >> if (!vbt) >> goto err_not_found; >>
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index 76a8f001f4c4..310609d186cd 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915) vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER); vbt_size &= 0xffff; - vbt = kzalloc(vbt_size, GFP_KERNEL); + vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL); if (!vbt) goto err_not_found;
If VBT size is not a multiple of 4, the last 4-byte store will be out of bounds of the allocated buffer. Spotted with KASAN. Round up the allocation size. Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller") Cc: Clint Taylor <clinton.a.taylor@intel.com> Cc: Lucas De Marchi <lucas.demarchi@intel.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com> --- drivers/gpu/drm/i915/display/intel_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)