lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 122/390] x86/microcode/AMD: Track patch allocation size explicitly
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit 712f210a457d9c32414df246a72781550bc23ef6 ]

    In preparation for reducing the use of ksize(), record the actual
    allocation size for later memcpy(). This avoids copying extra
    (uninitialized!) bytes into the patch buffer when the requested
    allocation size isn't exactly the size of a kmalloc bucket.
    Additionally, fix potential future issues where runtime bounds checking
    will notice that the buffer was allocated to a smaller value than
    returned by ksize().

    Fixes: 757885e94a22 ("x86, microcode, amd: Early microcode patch loading support for AMD")
    Suggested-by: Daniel Micay <danielmicay@gmail.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Link: https://lore.kernel.org/lkml/CA+DvKQ+bp7Y7gmaVhacjv9uF6Ar-o4tet872h4Q8RPYPJjcJQA@mail.gmail.com/
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/include/asm/microcode.h | 1 +
    arch/x86/kernel/cpu/microcode/amd.c | 3 ++-
    2 files changed, 3 insertions(+), 1 deletion(-)

    diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
    index 91a06cef50c1..f73327397b89 100644
    --- a/arch/x86/include/asm/microcode.h
    +++ b/arch/x86/include/asm/microcode.h
    @@ -9,6 +9,7 @@
    struct ucode_patch {
    struct list_head plist;
    void *data; /* Intel uses only this one */
    + unsigned int size;
    u32 patch_id;
    u16 equiv_cpu;
    };
    diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
    index 3f6b137ef4e6..c87936441339 100644
    --- a/arch/x86/kernel/cpu/microcode/amd.c
    +++ b/arch/x86/kernel/cpu/microcode/amd.c
    @@ -783,6 +783,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover,
    kfree(patch);
    return -EINVAL;
    }
    + patch->size = *patch_size;

    mc_hdr = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE);
    proc_id = mc_hdr->processor_rev_id;
    @@ -864,7 +865,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
    return ret;

    memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
    - memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));
    + memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE));

    return ret;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 18:11    [W:4.289 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site