drm/i915/gt: Avoid out-of-bounds access when loading HuC
authorLucas De Marchi <lucas.demarchi@intel.com>
Thu, 13 Apr 2023 20:03:49 +0000 (13:03 -0700)
committerLucas De Marchi <lucas.demarchi@intel.com>
Fri, 14 Apr 2023 15:55:45 +0000 (08:55 -0700)
commitadfbae9ffe339eed08d54a4eb87c93f4b35f214b
tree64bc63e7d61248609225792e824cfe426bec36be
parentb90b044c64f669cb20919fb5e5673933de59c653
drm/i915/gt: Avoid out-of-bounds access when loading HuC

When HuC is loaded by GSC, there is no header definition for the kernel
to look at and firmware is just handed to GSC. However when reading the
version, it should still check the size of the blob to guarantee it's not
incurring into out-of-bounds array access.

If firmware is smaller than expected, the following message is now
printed:

# echo boom > /lib/firmware/i915/dg2_huc_gsc.bin
# dmesg | grep -i huc
[drm] GT0: HuC firmware i915/dg2_huc_gsc.bin: invalid size: 5 < 184
[drm] *ERROR* GT0: HuC firmware i915/dg2_huc_gsc.bin: fetch failed -ENODATA
...

Even without this change the size, header and signature are still
checked by GSC when loading, so this only avoids the out-of-bounds array
access.

Fixes: a7b516bd981f ("drm/i915/huc: Add fetch support for gsc-loaded HuC binary")
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230413200349.3492571-1-lucas.demarchi@intel.com
drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c