]> git.baikalelectronics.ru Git - kernel.git/commit
drm/i915/dmc: protect against reading random memory
authorLucas De Marchi <lucas.demarchi@intel.com>
Wed, 5 Jun 2019 23:55:35 +0000 (16:55 -0700)
committerLucas De Marchi <lucas.demarchi@intel.com>
Fri, 7 Jun 2019 08:48:26 +0000 (01:48 -0700)
commitec8a4ce1fb86458838d820a26bf5f2f0cdda018f
tree616f2578848412d5a6cf851ac92d04d978461c74
parented2859936d3fb8080c651df514996295a173a763
drm/i915/dmc: protect against reading random memory

While loading the DMC firmware we were double checking the headers made
sense, but in no place we checked that we were actually reading memory
we were supposed to. This could be wrong in case the firmware file is
truncated or malformed.

Before this patch:
# ls -l /lib/firmware/i915/icl_dmc_ver1_07.bin
-rw-r--r-- 1 root root  25716 Feb  1 12:26 icl_dmc_ver1_07.bin
# truncate -s 25700 /lib/firmware/i915/icl_dmc_ver1_07.bin
# modprobe i915
# dmesg| grep -i dmc
[drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin
[drm] Finished loading DMC firmware i915/icl_dmc_ver1_07.bin (v1.7)

i.e. it loads random data. Now it fails like below:
[drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin
[drm:csr_load_work_fn [i915]] *ERROR* Truncated DMC firmware, rejecting.
i915 0000:00:02.0: Failed to load DMC firmware i915/icl_dmc_ver1_07.bin. Disabling runtime power management.
i915 0000:00:02.0: DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915

Before reading any part of the firmware file, validate the input first.

Fixes: d0d2fd5018d5 ("drm/i915/skl: Add support to load SKL CSR firmware.")
Cc: stable@vger.kernel.org
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190605235535.17791-1-lucas.demarchi@intel.com
drivers/gpu/drm/i915/intel_csr.c