Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1d8c928e authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

x86/microcode/AMD: Track patch allocation size explicitly 



[ Upstream commit 712f210a457d9c32414df246a72781550bc23ef6 ]

In preparation for reducing the use of ksize(), record the actual
allocation size for later memcpy(). This avoids copying extra
(uninitialized!) bytes into the patch buffer when the requested
allocation size isn't exactly the size of a kmalloc bucket.
Additionally, fix potential future issues where runtime bounds checking
will notice that the buffer was allocated to a smaller value than
returned by ksize().

Fixes: 757885e9 ("x86, microcode, amd: Early microcode patch loading support for AMD")
Suggested-by: default avatarDaniel Micay <danielmicay@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/lkml/CA+DvKQ+bp7Y7gmaVhacjv9uF6Ar-o4tet872h4Q8RPYPJjcJQA@mail.gmail.com/


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 215c146b

arch/x86/include/asm/microcode.h

+1 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
struct ucode_patch {

	struct list_head plist;

	void *data;		/* Intel uses only this one */

	unsigned int size;

	u32 patch_id;

	u16 equiv_cpu;

};

arch/x86/kernel/cpu/microcode/amd.c

+2 −1
Original line number Diff line number Diff line
@@ -783,6 +783,7 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover, 
		kfree(patch);

		return -EINVAL;

	}

	patch->size = *patch_size;



	mc_hdr      = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE);

	proc_id     = mc_hdr->processor_rev_id;
@@ -864,7 +865,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) 
		return ret;



	memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);

	memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));

	memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE));



	return ret;

}