* [char-misc-next] mei: hdcp: fix mei_hdcp_verify_mprime() input paramter
@ 2020-07-29 17:32 Tomas Winkler
2020-07-29 18:01 ` Gustavo A. R. Silva
0 siblings, 1 reply; 2+ messages in thread
From: Tomas Winkler @ 2020-07-29 17:32 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Alexander Usyskin, linux-kernel, Tomas Winkler, Ramalingam C,
Gustavo A . R . Silva
wired_cmd_repeater_auth_stream_req_in has a variable
length array at the end. we use struct_size() overflow
macro to determine the size for the allocation and sending
size.
Fixes: c56967d674e3 (mei: hdcp: Replace one-element array with flexible-array member)
Cc: Ramalingam C <ramalingam.c@intel.com>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
---
drivers/misc/mei/hdcp/mei_hdcp.c | 38 ++++++++++++++++++--------------
1 file changed, 22 insertions(+), 16 deletions(-)
diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c
index d1d3e025ca0e..0e8f12e38494 100644
--- a/drivers/misc/mei/hdcp/mei_hdcp.c
+++ b/drivers/misc/mei/hdcp/mei_hdcp.c
@@ -546,38 +546,44 @@ static int mei_hdcp_verify_mprime(struct device *dev,
struct hdcp_port_data *data,
struct hdcp2_rep_stream_ready *stream_ready)
{
- struct wired_cmd_repeater_auth_stream_req_in
- verify_mprime_in = { { 0 } };
+ struct wired_cmd_repeater_auth_stream_req_in *verify_mprime_in;
struct wired_cmd_repeater_auth_stream_req_out
verify_mprime_out = { { 0 } };
struct mei_cl_device *cldev;
ssize_t byte;
+ size_t cmd_size;
if (!dev || !stream_ready || !data)
return -EINVAL;
cldev = to_mei_cl_device(dev);
- verify_mprime_in.header.api_version = HDCP_API_VERSION;
- verify_mprime_in.header.command_id = WIRED_REPEATER_AUTH_STREAM_REQ;
- verify_mprime_in.header.status = ME_HDCP_STATUS_SUCCESS;
- verify_mprime_in.header.buffer_len =
+ cmd_size = struct_size(verify_mprime_in, streams, data->k);
+ if (cmd_size == SIZE_MAX)
+ return -EINVAL;
+
+ verify_mprime_in = kzalloc(cmd_size, GFP_KERNEL);
+
+ verify_mprime_in->header.api_version = HDCP_API_VERSION;
+ verify_mprime_in->header.command_id = WIRED_REPEATER_AUTH_STREAM_REQ;
+ verify_mprime_in->header.status = ME_HDCP_STATUS_SUCCESS;
+ verify_mprime_in->header.buffer_len =
WIRED_CMD_BUF_LEN_REPEATER_AUTH_STREAM_REQ_MIN_IN;
- verify_mprime_in.port.integrated_port_type = data->port_type;
- verify_mprime_in.port.physical_port = (u8)data->fw_ddi;
- verify_mprime_in.port.attached_transcoder = (u8)data->fw_tc;
+ verify_mprime_in->port.integrated_port_type = data->port_type;
+ verify_mprime_in->port.physical_port = (u8)data->fw_ddi;
+ verify_mprime_in->port.attached_transcoder = (u8)data->fw_tc;
+
+ memcpy(verify_mprime_in->m_prime, stream_ready->m_prime, HDCP_2_2_MPRIME_LEN);
+ drm_hdcp_cpu_to_be24(verify_mprime_in->seq_num_m, data->seq_num_m);
- memcpy(verify_mprime_in.m_prime, stream_ready->m_prime,
- HDCP_2_2_MPRIME_LEN);
- drm_hdcp_cpu_to_be24(verify_mprime_in.seq_num_m, data->seq_num_m);
- memcpy(verify_mprime_in.streams, data->streams,
+ memcpy(verify_mprime_in->streams, data->streams,
array_size(data->k, sizeof(*data->streams)));
- verify_mprime_in.k = cpu_to_be16(data->k);
+ verify_mprime_in->k = cpu_to_be16(data->k);
- byte = mei_cldev_send(cldev, (u8 *)&verify_mprime_in,
- sizeof(verify_mprime_in));
+ byte = mei_cldev_send(cldev, (u8 *)&verify_mprime_in, cmd_size);
+ kfree(verify_mprime_in);
if (byte < 0) {
dev_dbg(dev, "mei_cldev_send failed. %zd\n", byte);
return byte;
--
2.25.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [char-misc-next] mei: hdcp: fix mei_hdcp_verify_mprime() input paramter
2020-07-29 17:32 [char-misc-next] mei: hdcp: fix mei_hdcp_verify_mprime() input paramter Tomas Winkler
@ 2020-07-29 18:01 ` Gustavo A. R. Silva
0 siblings, 0 replies; 2+ messages in thread
From: Gustavo A. R. Silva @ 2020-07-29 18:01 UTC (permalink / raw)
To: Tomas Winkler, Greg Kroah-Hartman
Cc: Alexander Usyskin, linux-kernel, Ramalingam C, Gustavo A . R . Silva
On 7/29/20 12:32, Tomas Winkler wrote:
> wired_cmd_repeater_auth_stream_req_in has a variable
> length array at the end. we use struct_size() overflow
> macro to determine the size for the allocation and sending
> size.
>
> Fixes: c56967d674e3 (mei: hdcp: Replace one-element array with flexible-array member)
This also fixes:
commit 0a1af1b5c18d ("misc/mei/hdcp: Verify M_prime")
which introduced a potential stack overflow back in Feb 2019, hence it should be
fixed in -stable, too.
So, either both commit c56967d674e3 (mei: hdcp: Replace one-element array with flexible-array member)
and this patch should be ported to -stable in order to fix a potential
stack overflow due to commit 0a1af1b5c18d ("misc/mei/hdcp: Verify M_prime"),
or a separate fix that doesn't touch the one-element array streams[1] in struct
wired_cmd_repeater_auth_stream_req_in, but addresses the stack overflow should
be crafted and applied to -stable.
I can write that fix up for -stable if you want to go in that direction. Just let
me know.
> Cc: Ramalingam C <ramalingam.c@intel.com>
> Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
> ---
> drivers/misc/mei/hdcp/mei_hdcp.c | 38 ++++++++++++++++++--------------
> 1 file changed, 22 insertions(+), 16 deletions(-)
>
> diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c
> index d1d3e025ca0e..0e8f12e38494 100644
> --- a/drivers/misc/mei/hdcp/mei_hdcp.c
> +++ b/drivers/misc/mei/hdcp/mei_hdcp.c
> @@ -546,38 +546,44 @@ static int mei_hdcp_verify_mprime(struct device *dev,
> struct hdcp_port_data *data,
> struct hdcp2_rep_stream_ready *stream_ready)
> {
> - struct wired_cmd_repeater_auth_stream_req_in
> - verify_mprime_in = { { 0 } };
> + struct wired_cmd_repeater_auth_stream_req_in *verify_mprime_in;
> struct wired_cmd_repeater_auth_stream_req_out
> verify_mprime_out = { { 0 } };
> struct mei_cl_device *cldev;
> ssize_t byte;
> + size_t cmd_size;
>
> if (!dev || !stream_ready || !data)
> return -EINVAL;
>
> cldev = to_mei_cl_device(dev);
>
> - verify_mprime_in.header.api_version = HDCP_API_VERSION;
> - verify_mprime_in.header.command_id = WIRED_REPEATER_AUTH_STREAM_REQ;
> - verify_mprime_in.header.status = ME_HDCP_STATUS_SUCCESS;
> - verify_mprime_in.header.buffer_len =
> + cmd_size = struct_size(verify_mprime_in, streams, data->k);
> + if (cmd_size == SIZE_MAX)
> + return -EINVAL;
> +
> + verify_mprime_in = kzalloc(cmd_size, GFP_KERNEL);
> +
> + verify_mprime_in->header.api_version = HDCP_API_VERSION;
> + verify_mprime_in->header.command_id = WIRED_REPEATER_AUTH_STREAM_REQ;
> + verify_mprime_in->header.status = ME_HDCP_STATUS_SUCCESS;
> + verify_mprime_in->header.buffer_len =
> WIRED_CMD_BUF_LEN_REPEATER_AUTH_STREAM_REQ_MIN_IN;
>
> - verify_mprime_in.port.integrated_port_type = data->port_type;
> - verify_mprime_in.port.physical_port = (u8)data->fw_ddi;
> - verify_mprime_in.port.attached_transcoder = (u8)data->fw_tc;
> + verify_mprime_in->port.integrated_port_type = data->port_type;
> + verify_mprime_in->port.physical_port = (u8)data->fw_ddi;
> + verify_mprime_in->port.attached_transcoder = (u8)data->fw_tc;
> +
> + memcpy(verify_mprime_in->m_prime, stream_ready->m_prime, HDCP_2_2_MPRIME_LEN);
> + drm_hdcp_cpu_to_be24(verify_mprime_in->seq_num_m, data->seq_num_m);
>
> - memcpy(verify_mprime_in.m_prime, stream_ready->m_prime,
> - HDCP_2_2_MPRIME_LEN);
> - drm_hdcp_cpu_to_be24(verify_mprime_in.seq_num_m, data->seq_num_m);
> - memcpy(verify_mprime_in.streams, data->streams,
> + memcpy(verify_mprime_in->streams, data->streams,
> array_size(data->k, sizeof(*data->streams)));
Please, use flex_array_size() instead of array_size() here, like this:
memcpy(verify_mprime_in->streams, data->streams,
flex_array_size(verify_mprime_in, streams, data->k));
Thanks
--
Gustavo
>
> - verify_mprime_in.k = cpu_to_be16(data->k);
> + verify_mprime_in->k = cpu_to_be16(data->k);
>
> - byte = mei_cldev_send(cldev, (u8 *)&verify_mprime_in,
> - sizeof(verify_mprime_in));
> + byte = mei_cldev_send(cldev, (u8 *)&verify_mprime_in, cmd_size);
> + kfree(verify_mprime_in);
> if (byte < 0) {
> dev_dbg(dev, "mei_cldev_send failed. %zd\n", byte);
> return byte;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-07-29 17:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-29 17:32 [char-misc-next] mei: hdcp: fix mei_hdcp_verify_mprime() input paramter Tomas Winkler
2020-07-29 18:01 ` Gustavo A. R. Silva
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.