The CPD manifest offset was dereferenced without checking the bounds first. Therefore, ensure the offset and manifest header fit within the CPD region before reading the GSC manifest.
Also, validate CPD header length before using it to size the CPD entry table, and cast the boot1 partition's offset and size to size_t to avoid an integer overflow. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: - Removed unneeded manifest offset check against CPD header (Daniele) - Saved sub_partition_offset to cpd_offset variable (Daniele) - Added parenthesis to manifest bounds check (Daniele) Reported-by: Martin Hodo <[email protected]> Fixes: 56fafa569764 ("drm/i915/mtl/gsc: extract release and security versions from the gsc binary") Cc: Daniele Ceraolo Spurio <[email protected]> Cc: Alan Previn <[email protected]> Cc: <[email protected]> # v6.6+ Signed-off-by: Jesus Narvaez <[email protected]> --- drivers/gpu/drm/i915/gt/uc/intel_gsc_fw.c | 27 ++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/uc/intel_gsc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_gsc_fw.c index d550eb6edfb8..ab6c19d4125f 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_gsc_fw.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_gsc_fw.c @@ -82,6 +82,7 @@ int intel_gsc_fw_get_binary_info(struct intel_uc_fw *gsc_fw, const void *data, s const struct intel_gsc_manifest_header *manifest; struct intel_uc_fw_ver min_ver = { 0 }; size_t min_size = sizeof(*layout); + u32 cpd_offset = 0; int i; if (size < min_size) { @@ -139,7 +140,7 @@ int intel_gsc_fw_get_binary_info(struct intel_uc_fw *gsc_fw, const void *data, s * -------------------------------------------------- */ - min_size = layout->boot1.offset + layout->boot1.size; + min_size = (size_t)layout->boot1.offset + layout->boot1.size; if (size < min_size) { gt_err(gt, "GSC FW too small for boot section! %zu < %zu\n", size, min_size); @@ -173,8 +174,9 @@ int intel_gsc_fw_get_binary_info(struct intel_uc_fw *gsc_fw, const void *data, s INTEL_GSC_BPDT_ENTRY_TYPE_GSC_RBE) continue; - cpd_header = (void *)bpdt_header + bpdt_entry->sub_partition_offset; - min_size = bpdt_entry->sub_partition_offset + sizeof(*cpd_header); + cpd_offset = bpdt_entry->sub_partition_offset; + cpd_header = (void *)bpdt_header + cpd_offset; + min_size = cpd_offset + sizeof(*cpd_header); break; } @@ -195,7 +197,14 @@ int intel_gsc_fw_get_binary_info(struct intel_uc_fw *gsc_fw, const void *data, s return -EINVAL; } - min_size += sizeof(*cpd_entry) * cpd_header->num_of_entries; + if (cpd_header->header_length < sizeof(struct intel_gsc_cpd_header_v2)) { + gt_err(gt, "invalid CPD header length in GSC bin: %u < %zu!\n", + cpd_header->header_length, sizeof(*cpd_header)); + return -EINVAL; + } + + min_size = cpd_offset + cpd_header->header_length + + sizeof(*cpd_entry) * cpd_header->num_of_entries; if (layout->boot1.size < min_size) { gt_err(gt, "GSC FW boot section too small for CPD entries: %u < %zu\n", layout->boot1.size, min_size); @@ -205,7 +214,15 @@ int intel_gsc_fw_get_binary_info(struct intel_uc_fw *gsc_fw, const void *data, s cpd_entry = (void *)cpd_header + cpd_header->header_length; for (i = 0; i < cpd_header->num_of_entries; i++, cpd_entry++) { if (strcmp(cpd_entry->name, "RBEP.man") == 0) { - manifest = (void *)cpd_header + cpd_entry_offset(cpd_entry); + u32 man_off = cpd_entry_offset(cpd_entry); + + if ((man_off + sizeof(struct intel_gsc_manifest_header)) > + (layout->boot1.size - cpd_offset)) { + gt_err(gt, "GSC FW boot section too small for manifest: %u < %zu\n", + layout->boot1.size, man_off + sizeof(*manifest)); + return -ENODATA; + } + manifest = (void *)cpd_header + man_off; intel_uc_fw_version_from_gsc_manifest(&gsc->release, manifest); gsc->security_version = manifest->security_version; -- 2.43.0
