Intel-GFX Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2 1/2] drm/i915/huc: Validate the CPD entry offset before manifest read
@ 2026-09-16 17:26 Jesus Narvaez
  2026-09-16 17:26 ` [PATCH v2 2/2] drm/i915/gsc: " Jesus Narvaez
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Jesus Narvaez @ 2026-09-16 17:26 UTC (permalink / raw)
  To: intel-gfx
  Cc: Jesus Narvaez, Martin Hodo, Daniele Ceraolo Spurio, Alan Previn,
	stable

The CPD manifest offset was dereferenced without checking whether the
offset was out of bounds or not. Validate the offset is within the FW
blob before continuing with the read.

Discovered using AI-assisted static analysis confirmed by Intel Product
Security.

v2:
  - Add parenthesis to clarify offset check (Daniele)

Reported-by: Martin Hodo <martin.hodo@intel.com>
Fixes: 93a575ab1533 ("drm/i915/huc: Parse the GSC-enabled HuC binary")
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
Cc: <stable@vger.kernel.org> # v6.5+
Signed-off-by: Jesus Narvaez <jesus.narvaez@intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
---
 drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c
index b648238cc675..3560961d606f 100644
--- a/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_huc_fw.c
@@ -216,9 +216,19 @@ int intel_huc_fw_get_binary_info(struct intel_uc_fw *huc_fw, const void *data, s
 	entry = data + header->header_length;
 
 	for (i = 0; i < header->num_of_entries; i++, entry++) {
-		if (strcmp(entry->name, "HUCP.man") == 0)
+		if (strcmp(entry->name, "HUCP.man") == 0) {
+			u32 offset = entry_offset(entry);
+
+			if (offset >= size ||
+			    ((size - offset) < sizeof(struct intel_gsc_manifest_header))) {
+				huc_err(huc, "CPD manifest offset 0x%x out of bounds (size %zu)\n",
+					offset, size);
+				return -ENODATA;
+			}
+
 			intel_uc_fw_version_from_gsc_manifest(&huc_fw->file_selected.ver,
-							      data + entry_offset(entry));
+							      data + offset);
+		}
 
 		if (strcmp(entry->name, "huc_fw") == 0) {
 			u32 offset = entry_offset(entry);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-09-17  3:08 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-16 17:26 [PATCH v2 1/2] drm/i915/huc: Validate the CPD entry offset before manifest read Jesus Narvaez
2026-09-16 17:26 ` [PATCH v2 2/2] drm/i915/gsc: " Jesus Narvaez
2026-09-16 17:35   ` sashiko-bot
2026-09-16 18:34 ` ✓ i915.CI.BAT: success for series starting with [v2,1/2] drm/i915/huc: " Patchwork
2026-09-17  3:08 ` ✗ i915.CI.Full: failure " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox