On Wed, 22 Dec 2021, Jani Nikula <[email protected]> wrote: > If VBT size is not a multiple of 4, the last 4-byte store will be out of > bounds of the allocated buffer. Spotted with KASAN. Round up the > allocation size. > > v2: Use round_up() intead of roundup() as it's a power of 2 (Thomas) > > Reported-by: Thomas Hellström <[email protected]> > Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller") > Cc: Clint Taylor <[email protected]> > Cc: Lucas De Marchi <[email protected]> > Reviewed-by: Thomas Hellström <[email protected]> > Signed-off-by: Jani Nikula <[email protected]>
Pushed, thanks for the report and review. BR, Jani. > --- > drivers/gpu/drm/i915/display/intel_bios.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/display/intel_bios.c > b/drivers/gpu/drm/i915/display/intel_bios.c > index 76a8f001f4c4..c7a8d517ce81 100644 > --- a/drivers/gpu/drm/i915/display/intel_bios.c > +++ b/drivers/gpu/drm/i915/display/intel_bios.c > @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct > drm_i915_private *i915) > vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER); > vbt_size &= 0xffff; > > - vbt = kzalloc(vbt_size, GFP_KERNEL); > + vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL); > if (!vbt) > goto err_not_found; -- Jani Nikula, Intel Open Source Graphics Center
