From: Greg KH <greg@kroah.com>
To: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: stable@vger.kernel.org, intel-gfx@lists.freedesktop.org
Subject: Re: [PATCH stable-4.9+] drm/i915/dmc: protect against reading random memory
Date: Wed, 3 Jul 2019 14:14:16 +0200 [thread overview]
Message-ID: <20190703121416.GD7784@kroah.com> (raw)
In-Reply-To: <20190702192304.31955-1-lucas.demarchi@intel.com>
On Tue, Jul 02, 2019 at 12:23:04PM -0700, Lucas De Marchi wrote:
> commit bc7b488b1d1c71dc4c5182206911127bc6c410d6 upstream.
>
> While loading the DMC firmware we were double checking the headers made
> sense, but in no place we checked that we were actually reading memory
> we were supposed to. This could be wrong in case the firmware file is
> truncated or malformed.
>
> Before this patch:
> # ls -l /lib/firmware/i915/icl_dmc_ver1_07.bin
> -rw-r--r-- 1 root root 25716 Feb 1 12:26 icl_dmc_ver1_07.bin
> # truncate -s 25700 /lib/firmware/i915/icl_dmc_ver1_07.bin
> # modprobe i915
> # dmesg| grep -i dmc
> [drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin
> [drm] Finished loading DMC firmware i915/icl_dmc_ver1_07.bin (v1.7)
>
> i.e. it loads random data. Now it fails like below:
> [drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin
> [drm:csr_load_work_fn [i915]] *ERROR* Truncated DMC firmware, rejecting.
> i915 0000:00:02.0: Failed to load DMC firmware i915/icl_dmc_ver1_07.bin. Disabling runtime power management.
> i915 0000:00:02.0: DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915
>
> Before reading any part of the firmware file, validate the input first.
>
> Fixes: eb805623d8b1 ("drm/i915/skl: Add support to load SKL CSR firmware.")
> Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20190605235535.17791-1-lucas.demarchi@intel.com
> (cherry picked from commit bc7b488b1d1c71dc4c5182206911127bc6c410d6)
> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
> [ Lucas: backported to 4.9+ adjusting the context ]
> Cc: stable@vger.kernel.org # v4.9+
What about a 4.14.y and 4.19.y backport as well? I can't take this
without those as we do not want people to upgrade and have a regression.
thanks,
greg k-h
next prev parent reply other threads:[~2019-07-03 12:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-02 19:23 [PATCH stable-4.9+] drm/i915/dmc: protect against reading random memory Lucas De Marchi
2019-07-03 12:14 ` Greg KH [this message]
2019-07-03 16:24 ` Lucas De Marchi
2019-07-03 22:58 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190703121416.GD7784@kroah.com \
--to=greg@kroah.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=lucas.demarchi@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).