Re: [Intel-gfx] [PATCH v2] drm/i915/bios: fix slab-out-of-bounds access

[Jani Nikula <jani.nikula@intel.com>]

On Wed, 22 Dec 2021, Jani Nikula <jani.nikula@intel.com> wrote:
> If VBT size is not a multiple of 4, the last 4-byte store will be out of
> bounds of the allocated buffer. Spotted with KASAN. Round up the
> allocation size.
>
> v2: Use round_up() intead of roundup() as it's a power of 2 (Thomas)
>
> Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller")
> Cc: Clint Taylor <clinton.a.taylor@intel.com>
> Cc: Lucas De Marchi <lucas.demarchi@intel.com>
> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Signed-off-by: Jani Nikula <jani.nikula@intel.com>

Pushed, thanks for the report and review.

BR,
Jani.


> ---
>  drivers/gpu/drm/i915/display/intel_bios.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index 76a8f001f4c4..c7a8d517ce81 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915)
>  	vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER);
>  	vbt_size &= 0xffff;
>  
> -	vbt = kzalloc(vbt_size, GFP_KERNEL);
> +	vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL);
>  	if (!vbt)
>  		goto err_not_found;

-- 
Jani Nikula, Intel Open Source Graphics Center