[Intel-gfx] [PATCH stable-4.9+] drm/i915/dmc: protect against reading random memory

[Greg KH]

On Tue, Jul 02, 2019 at 12:23:04PM -0700, Lucas De Marchi wrote:
> commit bc7b488b1d1c71dc4c5182206911127bc6c410d6 upstream.
> 
> While loading the DMC firmware we were double checking the headers made
> sense, but in no place we checked that we were actually reading memory
> we were supposed to. This could be wrong in case the firmware file is
> truncated or malformed.
> 
> Before this patch:
> 	# ls -l /lib/firmware/i915/icl_dmc_ver1_07.bin
> 	-rw-r--r-- 1 root root  25716 Feb  1 12:26 icl_dmc_ver1_07.bin
> 	# truncate -s 25700 /lib/firmware/i915/icl_dmc_ver1_07.bin
> 	# modprobe i915
> 	# dmesg| grep -i dmc
> 	[drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin
> 	[drm] Finished loading DMC firmware i915/icl_dmc_ver1_07.bin (v1.7)
> 
> i.e. it loads random data. Now it fails like below:
> 	[drm:intel_csr_ucode_init [i915]] Loading i915/icl_dmc_ver1_07.bin
> 	[drm:csr_load_work_fn [i915]] *ERROR* Truncated DMC firmware, rejecting.
> 	i915 0000:00:02.0: Failed to load DMC firmware i915/icl_dmc_ver1_07.bin. Disabling runtime power management.
> 	i915 0000:00:02.0: DMC firmware homepage: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915
> 
> Before reading any part of the firmware file, validate the input first.
> 
> Fixes: eb805623d8b1 ("drm/i915/skl: Add support to load SKL CSR firmware.")
> Signed-off-by: Lucas De Marchi <lucas.demarchi at intel.com>
> Reviewed-by: Rodrigo Vivi <rodrigo.vivi at intel.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20190605235535.17791-1-lucas.demarchi@intel.com
> (cherry picked from commit bc7b488b1d1c71dc4c5182206911127bc6c410d6)
> Signed-off-by: Jani Nikula <jani.nikula at intel.com>
> [ Lucas: backported to 4.9+ adjusting the context ]
> Cc: stable at vger.kernel.org # v4.9+

What about a 4.14.y and 4.19.y backport as well?   I can't take this
without those as we do not want people to upgrade and have a regression.

thanks,

greg k-h