lkml.org 
[lkml]   [2011]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [Stable-review] [56/74] x86, microcode, AMD: Extend ucode size verification
    On Thu, Apr 14, 2011 at 03:41:25AM -0400, Borislav Petkov wrote:

    [..]

    > > > +static unsigned int verify_ucode_size(int cpu, const u8 *buf, unsigned int size)
    > > > +{
    > > > + struct cpuinfo_x86 *c = &cpu_data(cpu);
    > > > + unsigned int max_size, actual_size;
    > > > +
    > > > +#define F1XH_MPB_MAX_SIZE 2048
    > > > +#define F14H_MPB_MAX_SIZE 1824
    > > > +#define F15H_MPB_MAX_SIZE 4096
    > > > +
    > > > + switch (c->x86) {
    > > > + case 0x14:
    > > > + max_size = F14H_MPB_MAX_SIZE;
    > > > + break;
    > > > + case 0x15:
    > > > + max_size = F15H_MPB_MAX_SIZE;
    > > > + break;
    > > > + default:
    > > > + max_size = F1XH_MPB_MAX_SIZE;
    > > > + break;
    > > > + }
    > > > +
    > > > + actual_size = buf[4] + (buf[5] << 8);
    > > > +
    > > > + if (actual_size > size || actual_size > max_size) {
    > >
    > > Surely:
    > >
    > > if (actual_size + UCODE_CONTAINER_SECTION_HDR > size || ...
    >
    > Well, not really because the UCODE_CONTAINER_SECTION_HDR is just 8 bytes
    > of patch header before each ucode patch and we don't copy it. So the
    > first part of the check is to see whether the ucode patch we're looking
    > at is incomplete and the ucode file is truncated.
    >
    > That's why we skip the 8 bytes when we do get_ucode_data() later.

    Actually, scratch that. I think you're right - this is a bug in the
    original code since the check there ignored those 8 bytes too:

    total_size = (unsigned long) (section_hdr[4] + (section_hdr[5] << 8));

    printk(KERN_DEBUG "microcode: size %u, total_size %u\n",
    size, total_size);

    if (total_size > size || total_size > UCODE_MAX_SIZE) {
    printk(KERN_ERR "microcode: error: size mismatch\n");
    return NULL;
    }

    Btw, while staring at it, I've found another discrepancy that needs to
    be fixed, I'll whip up a patch soon.

    Thanks.

    --
    Regards/Gruss,
    Boris.

    Advanced Micro Devices GmbH
    Einsteinring 24, 85609 Dornach
    General Managers: Alberto Bozzo, Andrew Bowd
    Registration: Dornach, Gemeinde Aschheim, Landkreis Muenchen
    Registergericht Muenchen, HRB Nr. 43632


    \
     
     \ /
      Last update: 2011-04-14 10:21    [W:0.023 / U:135.460 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site