From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 677A3C352A1 for ; Mon, 7 Feb 2022 11:14:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355707AbiBGLMo (ORCPT ); Mon, 7 Feb 2022 06:12:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241766AbiBGLJ0 (ORCPT ); Mon, 7 Feb 2022 06:09:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54EFFC043189; Mon, 7 Feb 2022 03:09:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1833FB80EE8; Mon, 7 Feb 2022 11:09:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36DC4C004E1; Mon, 7 Feb 2022 11:09:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232162; bh=JE/jV0p/vLig4xTmzfQk4lQFfn7O51vh4mZW9DF20YE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jim5i8dYX+IxzhKmooh5bFqB4lPY17AR5h5inImjSYmhHQOAq1TO5Y4nC6jqP0kEt hfnkYagFTiYP6AfUbkdYjrgIGlgXBEbXpUMMTGMHmf1GMDycShyDguzHMcDk02O9Z6 QqX/zDzDFV3tw0fZH+VWV4PTaaL7Ic9TkFgjAARg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nick Lopez , Ilia Mirkin , Karol Herbst Subject: [PATCH 4.9 36/48] drm/nouveau: fix off by one in BIOS boundary checking Date: Mon, 7 Feb 2022 12:06:09 +0100 Message-Id: <20220207103753.513983395@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103752.341184175@linuxfoundation.org> References: <20220207103752.341184175@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Nick Lopez commit 1b777d4d9e383d2744fc9b3a09af6ec1893c8b1a upstream. Bounds checking when parsing init scripts embedded in the BIOS reject access to the last byte. This causes driver initialization to fail on Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working console. This is probably only seen on OpenFirmware machines like PowerPC Macs because the BIOS image provided by OF is only the used parts of the ROM, not a power-of-two blocks read from PCI directly so PCs always have empty bytes at the end that are never accessed. Signed-off-by: Nick Lopez Fixes: 4d4e9907ff572 ("drm/nouveau/bios: guard against out-of-bounds accesses to image") Cc: # v4.10+ Reviewed-by: Ilia Mirkin Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20220122081906.2633061-1-github@glowingmonkey.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c @@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr += bios->imaged_addr; } - if (unlikely(*addr + size >= bios->size)) { + if (unlikely(*addr + size > bios->size)) { nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr); return false; }