All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/2] drm/i915/huc: Validate the CPD entry offset before manifest read
@ 2026-08-07 19:23 Jesus Narvaez
  2026-08-07 19:23 ` [PATCH 2/2] drm/i915/gsc: " Jesus Narvaez
                   ` (3 more replies)
  0 siblings, 4 replies; 8+ messages in thread
From: Jesus Narvaez @ 2026-08-07 19:23 UTC (permalink / raw)
  To: intel-gfx
  Cc: Jesus Narvaez, Martin Hodo, Daniele Ceraolo Spurio, Alan Previn,
	stable

The CPD manifest offset was dereferenced without checking whether the
offset was out of bounds or not. Validate the offset is within the FW
blob before continuing with the read.

Discovered using AI-assisted static analysis confirmed by Intel Product
Security.

Reported-by: Martin Hodo <martin.hodo@intel.com>
Fixes: 93a575ab1533 ("drm/i915/huc: Parse the GSC-enabled HuC binary")
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
Cc: <stable@vger.kernel.org> # v6.5+
Signed-off-by: Jesus Narvaez <jesus.narvaez@intel.com>
---
 drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c
index b648238cc675..b9cbcf973236 100644
--- a/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c
@@ -216,9 +216,19 @@ int intel_huc_fw_get_binary_info(struct intel_uc_fw *huc_fw, const void *data, s
 	entry = data + header->header_length;
 
 	for (i = 0; i < header->num_of_entries; i++, entry++) {
-		if (strcmp(entry->name, "HUCP.man") == 0)
+		if (strcmp(entry->name, "HUCP.man") == 0) {
+			u32 offset = entry_offset(entry);
+
+			if (offset >= size ||
+			    size - offset < sizeof(struct intel_gsc_manifest_header)) {
+				huc_err(huc, "CPD manifest offset 0x%x out of bounds (size %zu)\n",
+					offset, size);
+				return -ENODATA;
+			}
+
 			intel_uc_fw_version_from_gsc_manifest(&huc_fw->file_selected.ver,
-							      data + entry_offset(entry));
+							      data + offset);
+		}
 
 		if (strcmp(entry->name, "huc_fw") == 0) {
 			u32 offset = entry_offset(entry);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2026-09-13 12:22 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-07 19:23 [PATCH 1/2] drm/i915/huc: Validate the CPD entry offset before manifest read Jesus Narvaez
2026-08-07 19:23 ` [PATCH 2/2] drm/i915/gsc: " Jesus Narvaez
2026-08-25  2:28   ` Daniele Ceraolo Spurio
2026-09-11 15:53     ` Narvaez, Jesus
2026-09-13 12:22       ` Daniele Ceraolo Spurio
2026-08-08  4:14 ` ✓ i915.CI.BAT: success for series starting with [1/2] drm/i915/huc: " Patchwork
2026-08-08  6:31 ` ✗ i915.CI.Full: failure " Patchwork
2026-08-25  2:09 ` [PATCH 1/2] " Daniele Ceraolo Spurio

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.