[Intel-gfx] [PATCH] drm/i915/gvt: Fix out-of-bounds buffer write into opregion->signature[]

[Chris Wilson]

Quoting Zhenyu Wang (2017-11-21 03:19:51)
> On 2017.11.20 21:15:16 +0000, Chris Wilson wrote:
> > sparse spots
> > 
> > drivers/gpu/drm/i915/gvt/opregion.c:234 alloc_and_init_virt_opregion() error: memcpy() 'header->signature' too small (16 vs 17)
> > 
> > as gvt is indeed trying to memcpy a string longer than the signature[].
> > 
> > Fixes: b2d6ef70614e ("drm/i915/gvt: Let each vgpu has separate opregion memory")
> > Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> > Cc: Xiong Zhang <xiong.y.zhang at intel.com>
> > Cc: Zhenyu Wang <zhenyuw at linux.intel.com>
> > Cc: Zhi Wang <zhi.a.wang at intel.com>
> > Cc: intel-gvt-dev at lists.freedesktop.org
> > ---
> >  drivers/gpu/drm/i915/gvt/opregion.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
> > index 80720e59723a..3cf4c6f18152 100644
> > --- a/drivers/gpu/drm/i915/gvt/opregion.c
> > +++ b/drivers/gpu/drm/i915/gvt/opregion.c
> > @@ -232,7 +232,7 @@ static int alloc_and_init_virt_opregion(struct intel_vgpu *vgpu)
> >       buf = (u8 *)vgpu_opregion(vgpu)->va;
> >       header = (struct opregion_header *)buf;
> >       memcpy(header->signature, OPREGION_SIGNATURE,
> > -                     sizeof(OPREGION_SIGNATURE));
> > +                     sizeof(OPREGION_SIGNATURE) - 1);
> >       header->size = 0x8;
> >       header->opregion_ver = 0x02000000;
> >       header->mboxes = MBOX_VBT;
> > -- 
> 
> applied this, thanks!

It's not the best patch; after sleep I think you want

static const char opregion_signature[16] = "IntelFooBar";

memcpy(header->signature, opregion_signature, sizeof(opregion_signature));
-Chris