mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-11 19:19:42 +00:00
Code Issues Releases Wiki Activity

drm/i915/bios: fix slab-out-of-bounds access

Browse source 
If VBT size is not a multiple of 4, the last 4-byte store will be out of
bounds of the allocated buffer. Spotted with KASAN. Round up the
allocation size.

v2: Use round_up() intead of roundup() as it's a power of 2 (Thomas)

Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Fixes: a36e7dc0af ("drm/i915/dg1: Read OPROM via SPI controller")
Cc: Clint Taylor <clinton.a.taylor@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211222081654.1843211-1-jani.nikula@intel.com
This commit is contained in:
Jani Nikula 2021-12-22 10:16:54 +02:00
parent 825ca9ed1c
commit 980f42e7d5
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/gpu/drm/i915/display/intel_bios.c
View file

@ -2369,7 +2369,7 @@ static struct vbt_header *spi_oprom_get_vbt(struct drm_i915_private *i915)
vbt_size = intel_uncore_read(&i915->uncore, PRIMARY_SPI_TRIGGER);
vbt_size &= 0xffff;
vbt = kzalloc(vbt_size, GFP_KERNEL);
vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL);
if (!vbt)
goto err_not_found;