On Tue, 21 Dec 2021, Thomas Hellström <thomas.hellstrom@xxxxxxxxxxxxxxx> wrote:
> On 12/21/21 14:08, Jani Nikula wrote:
>> If VBT size is not a multiple of 4, the last 4-byte store will be out of
>> bounds of the allocated buffer. Spotted with KASAN. Round up the
>> allocation size.
>>
>> Reported-by: Thomas Hellström <thomas.hellstrom@xxxxxxxxxxxxxxx>
>> Fixes: a36e7dc0af1c ("drm/i915/dg1: Read OPROM via SPI controller")
>> Cc: Clint Taylor <clinton.a.taylor@xxxxxxxxx>
>> Cc: Lucas De Marchi <lucas.demarchi@xxxxxxxxx>
>> Signed-off-by: Jani Nikula <jani.nikula@xxxxxxxxx>
>
>
>> ---
>> drivers/gpu/drm/i915/display/intel_bios.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
>> index 76a8f001f4c4..310609d186cd 100644
>> --- a/drivers/gpu/drm/i915/display/intel_bios.c
>> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
>> @@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915)
>> vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER);
>> vbt_size &= 0xffff;
>>
>> - vbt = kzalloc(vbt_size, GFP_KERNEL);
>> + vbt = kzalloc(roundup(vbt_size, 4), GFP_KERNEL);
>
> Use round_up since a power of 2?
Oh, right, *obviously* the underscored version is for powers of two. :p
v2 sent.
> Reviewed-by: Thomas Hellström <thomas.hellstrom@xxxxxxxxxxxxxxx>
Thanks,
Jani.
>
>> if (!vbt)
>> goto err_not_found;
>>
--
Jani Nikula, Intel Open Source Graphics Center
