Messages in this thread | | | From | "Gustavo A. R. Silva" <> | Subject | Re: [char-misc-next] mei: hdcp: fix mei_hdcp_verify_mprime() input paramter | Date | Wed, 29 Jul 2020 13:01:05 -0500 |
| |
On 7/29/20 12:32, Tomas Winkler wrote: > wired_cmd_repeater_auth_stream_req_in has a variable > length array at the end. we use struct_size() overflow > macro to determine the size for the allocation and sending > size. > > Fixes: c56967d674e3 (mei: hdcp: Replace one-element array with flexible-array member)
This also fixes:
commit 0a1af1b5c18d ("misc/mei/hdcp: Verify M_prime")
which introduced a potential stack overflow back in Feb 2019, hence it should be fixed in -stable, too.
So, either both commit c56967d674e3 (mei: hdcp: Replace one-element array with flexible-array member) and this patch should be ported to -stable in order to fix a potential stack overflow due to commit 0a1af1b5c18d ("misc/mei/hdcp: Verify M_prime"), or a separate fix that doesn't touch the one-element array streams[1] in struct wired_cmd_repeater_auth_stream_req_in, but addresses the stack overflow should be crafted and applied to -stable.
I can write that fix up for -stable if you want to go in that direction. Just let me know.
> Cc: Ramalingam C <ramalingam.c@intel.com> > Cc: Gustavo A. R. Silva <gustavoars@kernel.org> > Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> > --- > drivers/misc/mei/hdcp/mei_hdcp.c | 38 ++++++++++++++++++-------------- > 1 file changed, 22 insertions(+), 16 deletions(-) > > diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c > index d1d3e025ca0e..0e8f12e38494 100644 > --- a/drivers/misc/mei/hdcp/mei_hdcp.c > +++ b/drivers/misc/mei/hdcp/mei_hdcp.c > @@ -546,38 +546,44 @@ static int mei_hdcp_verify_mprime(struct device *dev, > struct hdcp_port_data *data, > struct hdcp2_rep_stream_ready *stream_ready) > { > - struct wired_cmd_repeater_auth_stream_req_in > - verify_mprime_in = { { 0 } }; > + struct wired_cmd_repeater_auth_stream_req_in *verify_mprime_in; > struct wired_cmd_repeater_auth_stream_req_out > verify_mprime_out = { { 0 } }; > struct mei_cl_device *cldev; > ssize_t byte; > + size_t cmd_size; > > if (!dev || !stream_ready || !data) > return -EINVAL; > > cldev = to_mei_cl_device(dev); > > - verify_mprime_in.header.api_version = HDCP_API_VERSION; > - verify_mprime_in.header.command_id = WIRED_REPEATER_AUTH_STREAM_REQ; > - verify_mprime_in.header.status = ME_HDCP_STATUS_SUCCESS; > - verify_mprime_in.header.buffer_len = > + cmd_size = struct_size(verify_mprime_in, streams, data->k); > + if (cmd_size == SIZE_MAX) > + return -EINVAL; > + > + verify_mprime_in = kzalloc(cmd_size, GFP_KERNEL); > + > + verify_mprime_in->header.api_version = HDCP_API_VERSION; > + verify_mprime_in->header.command_id = WIRED_REPEATER_AUTH_STREAM_REQ; > + verify_mprime_in->header.status = ME_HDCP_STATUS_SUCCESS; > + verify_mprime_in->header.buffer_len = > WIRED_CMD_BUF_LEN_REPEATER_AUTH_STREAM_REQ_MIN_IN; > > - verify_mprime_in.port.integrated_port_type = data->port_type; > - verify_mprime_in.port.physical_port = (u8)data->fw_ddi; > - verify_mprime_in.port.attached_transcoder = (u8)data->fw_tc; > + verify_mprime_in->port.integrated_port_type = data->port_type; > + verify_mprime_in->port.physical_port = (u8)data->fw_ddi; > + verify_mprime_in->port.attached_transcoder = (u8)data->fw_tc; > + > + memcpy(verify_mprime_in->m_prime, stream_ready->m_prime, HDCP_2_2_MPRIME_LEN); > + drm_hdcp_cpu_to_be24(verify_mprime_in->seq_num_m, data->seq_num_m); > > - memcpy(verify_mprime_in.m_prime, stream_ready->m_prime, > - HDCP_2_2_MPRIME_LEN); > - drm_hdcp_cpu_to_be24(verify_mprime_in.seq_num_m, data->seq_num_m); > - memcpy(verify_mprime_in.streams, data->streams, > + memcpy(verify_mprime_in->streams, data->streams, > array_size(data->k, sizeof(*data->streams)));
Please, use flex_array_size() instead of array_size() here, like this:
memcpy(verify_mprime_in->streams, data->streams, flex_array_size(verify_mprime_in, streams, data->k));
Thanks -- Gustavo
> > - verify_mprime_in.k = cpu_to_be16(data->k); > + verify_mprime_in->k = cpu_to_be16(data->k); > > - byte = mei_cldev_send(cldev, (u8 *)&verify_mprime_in, > - sizeof(verify_mprime_in)); > + byte = mei_cldev_send(cldev, (u8 *)&verify_mprime_in, cmd_size); > + kfree(verify_mprime_in); > if (byte < 0) { > dev_dbg(dev, "mei_cldev_send failed. %zd\n", byte); > return byte; >
| |