On Tue, Jul 02, 2019 at 12:23:04PM -0700, Lucas De Marchi wrote: > commit bc7b488b1d1c71dc4c5182206911127bc6c410d6 upstream. > > While loading the DMC firmware we were double checking the headers made > sense, but in no place we checked that we were actually reading memory > we were supposed to. This could be wrong in case the firmware file is > truncated or malformed. > > Before this patch: > # ls -l /lib/firmware/i915/icl_dmc_ver1_07.bin > -rw-r--r-- 1 root root 25716 Feb 1 12:26 icl_dmc_ver1_07.bin > # truncate -s 25700 /lib/firmware/i915/icl_dmc_ver1_07.bin > # modprobe i915 > # dmesg| grep -i dmc > [drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin > [drm] Finished loading DMC firmware i915/icl_dmc_ver1_07.bin (v1.7) > > i.e. it loads random data. Now it fails like below: > [drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin > [drm:csr_load_work_fn [i915]] *ERROR* Truncated DMC firmware, rejecting. > i915 0000:00:02.0: Failed to load DMC firmware i915/icl_dmc_ver1_07.bin. Disabling runtime power management. > i915 0000:00:02.0: DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915 > > Before reading any part of the firmware file, validate the input first. > > Fixes: eb805623d8b1 ("drm/i915/skl: Add support to load SKL CSR firmware.") > Signed-off-by: Lucas De Marchi <lucas.demarchi@xxxxxxxxx> > Reviewed-by: Rodrigo Vivi <rodrigo.vivi@xxxxxxxxx> > Link: https://patchwork.freedesktop.org/patch/msgid/20190605235535.17791-1-lucas.demarchi@xxxxxxxxx > (cherry picked from commit bc7b488b1d1c71dc4c5182206911127bc6c410d6) > Signed-off-by: Jani Nikula <jani.nikula@xxxxxxxxx> > [ Lucas: backported to 4.9+ adjusting the context ] > Cc: stable@xxxxxxxxxxxxxxx # v4.9+ What about a 4.14.y and 4.19.y backport as well? I can't take this without those as we do not want people to upgrade and have a regression. thanks, greg k-h
