From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Nick Lopez <github@glowingmonkey.org>,
Ilia Mirkin <imirkin@alum.mit.edu>,
Karol Herbst <kherbst@redhat.com>
Subject: [PATCH 4.9 36/48] drm/nouveau: fix off by one in BIOS boundary checking
Date: Mon, 7 Feb 2022 12:06:09 +0100 [thread overview]
Message-ID: <20220207103753.513983395@linuxfoundation.org> (raw)
In-Reply-To: <20220207103752.341184175@linuxfoundation.org>
From: Nick Lopez <github@glowingmonkey.org>
commit 1b777d4d9e383d2744fc9b3a09af6ec1893c8b1a upstream.
Bounds checking when parsing init scripts embedded in the BIOS reject
access to the last byte. This causes driver initialization to fail on
Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working
console.
This is probably only seen on OpenFirmware machines like PowerPC Macs
because the BIOS image provided by OF is only the used parts of the ROM,
not a power-of-two blocks read from PCI directly so PCs always have
empty bytes at the end that are never accessed.
Signed-off-by: Nick Lopez <github@glowingmonkey.org>
Fixes: 4d4e9907ff572 ("drm/nouveau/bios: guard against out-of-bounds accesses to image")
Cc: <stable@vger.kernel.org> # v4.10+
Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220122081906.2633061-1-github@glowingmonkey.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
@@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32
*addr += bios->imaged_addr;
}
- if (unlikely(*addr + size >= bios->size)) {
+ if (unlikely(*addr + size > bios->size)) {
nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr);
return false;
}
next prev parent reply other threads:[~2022-02-07 11:14 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-07 11:05 [PATCH 4.9 00/48] 4.9.300-rc1 review Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 01/48] can: bcm: fix UAF of bcm op Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 02/48] Bluetooth: refactor malicious adv data check Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 03/48] s390/hypfs: include z/VM guests with access control group set Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 04/48] scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 05/48] udf: Restore i_lenAlloc when inode expansion fails Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 06/48] udf: Fix NULL ptr deref when converting from inline format Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 07/48] PM: wakeup: simplify the output logic of pm_show_wakelocks() Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 08/48] serial: stm32: fix software flow control transfer Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 09/48] tty: n_gsm: fix SW flow control encoding/handling Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 10/48] tty: Add support for Brainboxes UC cards Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 11/48] usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 12/48] usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 13/48] USB: core: Fix hang in usb_kill_urb by adding memory barriers Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 14/48] powerpc/32: Fix boot failure with GCC latent entropy plugin Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 15/48] scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 16/48] ipv6_tunnel: Rate limit warning messages Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 17/48] net: fix information leakage in /proc/net/ptype Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 18/48] ipv4: avoid using shared IP generator for connected sockets Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 19/48] NFSv4: Handle case where the lookup of a directory fails Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 20/48] NFSv4: nfs_atomic_open() can race when looking up a non-regular file Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 21/48] net-procfs: show net devices bound packet types Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 22/48] drm/msm: Fix wrong size calculation Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 23/48] hwmon: (lm90) Reduce maximum conversion rate for G781 Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 24/48] ipv4: raw: lock the socket in raw_bind() Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 25/48] ipv4: tcp: send zero IPID in SYNACK messages Greg Kroah-Hartman
2022-02-07 11:05 ` [PATCH 4.9 26/48] netfilter: nat: remove l4 protocol port rovers Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 27/48] netfilter: nat: limit port clash resolution attempts Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 28/48] ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 29/48] net: amd-xgbe: ensure to reset the tx_timer_active flag Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 30/48] net: amd-xgbe: Fix skb data length underflow Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 31/48] rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 32/48] af_packet: fix data-race in packet_setsockopt / packet_setsockopt Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 33/48] ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 34/48] ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() Greg Kroah-Hartman
2022-06-03 10:06 ` Pavel Machek
2022-06-03 10:28 ` Mark Brown
2022-06-04 10:54 ` Mark Brown
2022-02-07 11:06 ` [PATCH 4.9 35/48] ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() Greg Kroah-Hartman
2022-02-07 11:06 ` Greg Kroah-Hartman [this message]
2022-02-07 11:06 ` [PATCH 4.9 37/48] iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 38/48] spi: bcm-qspi: check for valid cs before applying chip select Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 39/48] spi: mediatek: Avoid NULL pointer crash in interrupt Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 40/48] net: ieee802154: Return meaningful error codes from the netlink helpers Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 41/48] net: macsec: Verify that send_sci is on when setting Tx sci explicitly Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 42/48] ASoC: fsl: Add missing error handling in pcm030_fabric_probe Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 43/48] scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 44/48] nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 45/48] rtc: cmos: Evaluate century appropriate Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 46/48] EDAC/altera: Fix deferred probing Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 47/48] EDAC/xgene: " Greg Kroah-Hartman
2022-02-07 11:06 ` [PATCH 4.9 48/48] ext4: fix error handling in ext4_restore_inline_data() Greg Kroah-Hartman
2022-02-07 21:28 ` [PATCH 4.9 00/48] 4.9.300-rc1 review Shuah Khan
2022-02-07 22:20 ` Guenter Roeck
2022-02-07 23:07 ` Florian Fainelli
2022-02-08 1:45 ` Slade Watkins
2022-02-08 10:27 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220207103753.513983395@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=github@glowingmonkey.org \
--cc=imirkin@alum.mit.edu \
--cc=kherbst@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).