Received: by 2002:a05:6a10:af89:0:0:0:0 with SMTP id iu9csp2412082pxb; Sun, 30 Jan 2022 15:41:36 -0800 (PST) X-Google-Smtp-Source: ABdhPJyBfL9+w/9IeyMp/foFNJ37DGD1v5GJvTCh6PZZpXWlqt69oGJz8vsJmy6Z4xiDjwG+58kb X-Received: by 2002:a17:906:99c2:: with SMTP id s2mr14560835ejn.635.1643585997961; Sun, 30 Jan 2022 15:39:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643585997; cv=none; d=google.com; s=arc-20160816; b=Aa4lF73pEB2fbYM3Bz7tOT6MtL8PCtmabmwo6hejqtsIVzn9Imh4AtuVtAtsR02/uG mmW+h1xa4ffg6xiSYEVp9LV6n6esOQSkGXT/Q3Ha15VdNthU+QPyfsUtKITEv7pdsVl1 HJb+/h13kvUoNq0ulGfavoUECcYH0QgnEdOZj0GU5kfY6LjZ7HgPRDtJqc8ltcZd3D2G Bz82qeIJO9vw3W9jHacHx9b4dhJZEcbS6cqAYgFnV1e46De6HtJKw5hFxX23Bwhd5F1B ThdvI6jQYi3deIeOAmSBWz0ANBW2jMM7Zl27qFT51y+qKS/S6bj0bAiT9CtwWj21m9An FjOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=rpkOKe6oWRs4sQmtBdxf18g+bsU8yp6hY2F8cezFWe4=; b=oRbejiaAJUCW8rQTTLq5/gLFeFmsAUpZxG1qYO4S/urU7EEBf88JN4WUvJKm6yU+iR nwR0HpiVpcGK3/bJL2zVOFxOZ5CmTXURQOm8TFEb48bPOQTSNQbgWcTRzjGlNS1Kb2cY 6I5B03EpuizGH5kWcMOSqi5e+O94gw1E1GQ9gQR9IQpEhEvCzGoEYod3mfkxeHQxY1V2 CnX9DSwjzvKnrkxEJlseAuUgThUrxvx3okWBnLBNJzn25Q23LfkdYiAHQYfL89/RYlpT /+tzfEsTSRpzWOHjArVk3Q83M3ItSBtKIyfa3oguzdIIInbyA0Iv/9JeeC7wuO/WSetU 3koQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2K5AAwMp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id k11si6886641edi.193.2022.01.30.15.39.23; Sun, 30 Jan 2022 15:39:57 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2K5AAwMp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244032AbiA1KSY (ORCPT + 99 others); Fri, 28 Jan 2022 05:18:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347830AbiA1KSQ (ORCPT ); Fri, 28 Jan 2022 05:18:16 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F08EDC061755 for ; Fri, 28 Jan 2022 02:18:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9282C61E48 for ; Fri, 28 Jan 2022 10:18:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5372EC340F4; Fri, 28 Jan 2022 10:18:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643365095; bh=K+Wnlf3fVErqV3HKWur25sPL5zJVCNS2YRoj6ofC3uU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=2K5AAwMpNEB5WSDMIfE4CWnPMvSJM5Foa4dg6bQ2yBYvplO2/IPP6S3HMSzZK9cZQ fMqu/bVGPnH+1QVlxTGjbvhoZwAXxlwwUWhExKHC01M0hNV9GORJByqLt6mzzeVE9D NeJA0kga7NahzZmXXN5A/bnqTvhiYJSVeA/Dyu9I= Date: Fri, 28 Jan 2022 11:18:04 +0100 From: Greg KH To: Zhou Qingyang Cc: kjlu@umn.edu, Ben Skeggs , Karol Herbst , Lyude Paul , David Airlie , Daniel Vetter , dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() Message-ID: References: <20220124165856.57022-1-zhou1615@umn.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220124165856.57022-1-zhou1615@umn.edu> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jan 25, 2022 at 12:58:55AM +0800, Zhou Qingyang wrote: > In nvkm_acr_hsfw_load_bl(), the return value of kmalloc() is directly > passed to memcpy(), which could lead to undefined behavior on failure > of kmalloc(). > > Fix this bug by using kmemdup() instead of kmalloc()+memcpy(). > > This bug was found by a static analyzer. > > Builds with 'make allyesconfig' show no new warnings, > and our static analyzer no longer warns about this code. > > Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"") > Signed-off-by: Zhou Qingyang > --- > The analysis employs differential checking to identify inconsistent > security operations (e.g., checks or kfrees) between two code paths > and confirms that the inconsistent operations are not recovered in the > current function or the callers, so they constitute bugs. > > Note that, as a bug found by static analysis, it can be a false > positive or hard to trigger. Multiple researchers have cross-reviewed > the bug. > > drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c > index 667fa016496e..a6ea89a5d51a 100644 > --- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c > +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c > @@ -142,11 +142,12 @@ nvkm_acr_hsfw_load_bl(struct nvkm_acr *acr, const char *name, int ver, > > hsfw->imem_size = desc->code_size; > hsfw->imem_tag = desc->start_tag; > - hsfw->imem = kmalloc(desc->code_size, GFP_KERNEL); > - memcpy(hsfw->imem, data + desc->code_off, desc->code_size); > - > + hsfw->imem = kmemdup(data + desc->code_off, desc->code_size, GFP_KERNEL); > nvkm_firmware_put(fw); > - return 0; > + if (!hsfw->imem) > + return -ENOMEM; > + else > + return 0; > } > > int > -- > 2.25.1 > As stated before, umn.edu is still not allowed to contribute to the Linux kernel. Please work with your administration to resolve this issue.