From patchwork Tue Feb 27 14:54:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Armin Wolf X-Patchwork-Id: 207256 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp2746993dyb; Tue, 27 Feb 2024 06:55:48 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCUEv7qm8MC0Cicxc8YPvk3AQdov0ts9uMPpKFT9Us+DvBMDO86qRfRyeYbfWFHdcN9GN4scXWRwCLWwbg+YkI9E3jixQg== X-Google-Smtp-Source: AGHT+IGHCK/4CAfUZl34at2zto4tnUPyjDsKzBD25lGKk8JCgVEMvOnXyHK3Rn9rH/99t2WonuGN X-Received: by 2002:a05:620a:12ec:b0:787:3b62:d80e with SMTP id f12-20020a05620a12ec00b007873b62d80emr2333304qkl.27.1709045748009; Tue, 27 Feb 2024 06:55:48 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1709045747; cv=pass; d=google.com; s=arc-20160816; b=GG7BdYByrlGm6NyiO1OK6eWgHZhq/oYOsqdsMvCpIbuXZqPfRpMi5PkvMQCqRtuvAM X59cPyPeWHkVmsvDOoARnftu1VtCbWgkZye0/w8wWgLFreAj1EZkL4Tb9w9qZlp7pH+u CfssmKhexJAYBN2gT1jnPio7/7F+KJSMJucX8UT+f/9yeVViSPRh1BGTnSUaEyVkgfLi FZog8oOxyBI3jvoNWy/PMfuTsGW7iI6KBAf7MkPWcpo3OLe/LkO2zlTWe+uzhdn65qgy 5YlpbIkb6E3xHZGEpahBUV/XGCWE7MAFxlgRldsTNjLwm+WqKb2DT0LZ8pdpdE9qjHfa M5MQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=ui-outboundreport:content-transfer-encoding:mime-version :list-unsubscribe:list-subscribe:list-id:precedence:message-id:date :subject:cc:to:from:dkim-signature; bh=wSSFPlYL7+Zdo/pGscDdW+QJRDMH7glNlOHRGUSkY3o=; fh=Iw0cdpf9yN87ufu137c7ThcNR/cLOoX+JIMwqQQfbho=; b=pj+iw9IPhT58hJJbG4lGWmdQhgBBk+UiZtCudH5Ly/pWPSieKB71DA6PxFCJwPLzAY YSa/I0kTcdu5KLVo+JLjdjqJEjVJstM8knZ/OHeu8/VRFrtTpdmKqhPHRjvZKUmRno4P ZAN5sWw9/6/1mXqIHtljJ5RuAkZ5lHymmkKS4wVqgbFZLI6tHvdZW1+UJWS+RmUS7bHc ZNPUmYzzDFskOAlw38TSAq78Rlm2oC8IvcnpsbGUzS6xQl9wPyVsysM3qCYGCVsx7L+h ZqRVdGQX7J3yNTKpUGCy2cbGPWeFlnM7bSS2L13OpyU+/U0tFpO5Yyf+8dkJZg2eLVug mt0A==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@gmx.de header.s=s31663417 header.b=GROJXJV6; arc=pass (i=1 spf=pass spfdomain=gmx.de dkim=pass dkdomain=gmx.de dmarc=pass fromdomain=gmx.de); spf=pass (google.com: domain of linux-kernel+bounces-83435-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-83435-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=gmx.de Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [147.75.199.223]) by mx.google.com with ESMTPS id i7-20020a37c207000000b00787c0e79d2dsi7730261qkm.572.2024.02.27.06.55.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Feb 2024 06:55:47 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-83435-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223; Authentication-Results: mx.google.com; dkim=pass header.i=@gmx.de header.s=s31663417 header.b=GROJXJV6; arc=pass (i=1 spf=pass spfdomain=gmx.de dkim=pass dkdomain=gmx.de dmarc=pass fromdomain=gmx.de); spf=pass (google.com: domain of linux-kernel+bounces-83435-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-83435-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=gmx.de Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id AE3441C235E4 for ; Tue, 27 Feb 2024 14:55:32 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 76265143C4B; Tue, 27 Feb 2024 14:55:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b="GROJXJV6" Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C5411384B7; Tue, 27 Feb 2024 14:55:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.227.17.20 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045718; cv=none; b=bGeDqkiyvrH59QdkdbdvjXmSDT4+NLPO3NwdUiHfSUqeEJCBkiepNpzgHyooNCckA0N54XdbOHWz/I4QXwktBuHs1kA28NSY4xfAm/Riyrdqk9Yj2qgovDmOUw30H8Md7Tg/3pnA0kjjM61Ic6fBscilbKfg8EVUW9aOascw6PY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045718; c=relaxed/simple; bh=MrYA11ydrptEowbuZ9sMuc147woy6xuJ/hcpq4qtb0o=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=moDtMIEYJtq697N+ALhclXw9loMd+N9z402RsPg7crggppbjIW+2Wrnq6NHQ4DmQCK9gq60eeq1pLKFQZjGCGmHQrluDBeI92EajJzk4EMfnK26WfVVbwTVnM+64LRAmNy6l/q4UBLllOZ3Sc57vJ2Hz6044VFhSDWNr27393FY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de; spf=pass smtp.mailfrom=gmx.de; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b=GROJXJV6; arc=none smtp.client-ip=212.227.17.20 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.de; s=s31663417; t=1709045706; x=1709650506; i=w_armin@gmx.de; bh=MrYA11ydrptEowbuZ9sMuc147woy6xuJ/hcpq4qtb0o=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date; b=GROJXJV6thfdkh43yYiA7pMg6bBQOIT85UIY2BBvW8PraCp8lSdVh2HkPBenDk/W /uvBXAk2Ifa3F59oU81IugDQqew4NSWDNheGx1gqXwDilghN9z52Wz1u1DLyO7Nks 2JLS9Wg0xELMgi7KO5HSpdQHpSzGkxluC12HgFhgao3jJHCtRyhN90Nda4nMHd1jy j/BQ+Aly9EfDuXasZ2tAaJH0N+9F4LNBV15+U52UYNBeH4OyGwhh0tufCb9xTPI5h YQROsq3dFwBx8zzRhTeNYg1jMNd0lsTG4c1Q0ne/8Vdy2QZtZREsd6GP3goBG0Tn8 trZoKtyNx7aQUL9dgQ== X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a Received: from mx-amd-b650.users.agdsn.de ([141.30.226.129]) by mail.gmx.net (mrgmx105 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MMofc-1rMCzO1mZI-00Inal; Tue, 27 Feb 2024 15:55:06 +0100 From: Armin Wolf To: Shyam-sundar.S-k@amd.com Cc: hdegoede@redhat.com, ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/2] platform/x86/amd/pmf: Do not use readl() for policy buffer access Date: Tue, 27 Feb 2024 15:54:59 +0100 Message-Id: <20240227145500.299683-1-W_Armin@gmx.de> X-Mailer: git-send-email 2.39.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:8KiUowxFm24zflRHFezo2yJ/cJrOmOMZY/AlS3xfkTVnNy3VTYI +ddf09NQGCU6gAYOyOdu/nk3Kf6bSDjeekjJT8paBINFzSi2kIDQDFy4v7hmdAdm1xkrS10 nUr7QTQ4bB11MfW2BpVnXbmBo3fil38YTEamanCLMeV1c/oHvXPx6tzmA3DpCfKiQGXR4/v 73uB/UMRQr0gl4KvkoK8Q== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:a4bzPwQIcSM=;Eb8EQESCSjhnNAP1ad25UgGA6P6 b8CyjvkK1xvlXuGq7oXhYdLvjJ7nS6I39M41B/dYxMWP1hUbOguCBF21UfXqMeBjAv1+P6Mi9 BD6sCqAzPaVkviWaj9AEt+lwz2jaKcy4PLm1bDbdjk665kllTTUSc+sOb6qv/+9u4PE3ECl/B rhYeuTb5L9O7P3sc8xyBGYM49S8WPNUsVaD05DuLAcIau/5FIlxsLwaFYLFH0J89b6ClWTb5A +Bv+vWOCcerPMMIv3fRO91jem2Jp9kR/9oVgiRksFQlH5dkEydAww+H5l5c2tB0ba2FcEt1dr KXMSo/I7BKFEZo6OO4Qb0hNR+jDC+zT6ByEB8DANNp37Hc3EhN4qlZ29yJawsA3UGbC1/Gpon yrlYr7cgLM4/gD7ceezsCF/pzgovJx3vjF5J4qNIWKvp3HocBlZaApq54ourw8us1Kz+yPtrL NWMzaXslIXCp7ohAfHz91rS7GQTOb9Lmvw1iK+pr2Hw1zrTN6TLQuHQc6SW7jey56AaByJssk yK9r+uKWMcyqOSZ/BRSIeqVPiMHNnTliXbxITPDGuUaqVWjTKe8fNxPzW9CUmrC8t3aS8TCiI 3wAxrRL8S1goLkwgucNcycDsxFWbXkNf/CtO46890G0mkdjJRTHAzOlSi7jNqR69Qll2tZ3af 5PEUVIXfrEVreyvxUE/ZTiXLAfw6oFJzJQg6nvmM5J5iBv9Vyc6qOaPwFrLmyR6le1vLeow8I ce/mcmRDaMUGguGlzZhhak1BMZuX/0l/n4GkM8Qrc1d7Tro0Xb7EvmLbd9y265o3EZRBdg87N 5GM6JvBI44a+TWTjJ65sB8wVXFT++AsaYCtBMMlif35QU= X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1792061803502136850 X-GMAIL-MSGID: 1792064353998113588 The policy buffer is allocated using normal memory allocation functions, so readl() should not be used on it. Compile-tested only. Signed-off-by: Armin Wolf --- Changes since v1: - get the full dword instead of only 8 bits --- drivers/platform/x86/amd/pmf/tee-if.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.39.2 diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c index 16973bebf55f..b3491268b6a0 100644 --- a/drivers/platform/x86/amd/pmf/tee-if.c +++ b/drivers/platform/x86/amd/pmf/tee-if.c @@ -249,8 +249,8 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev) u32 cookie, length; int res; - cookie = readl(dev->policy_buf + POLICY_COOKIE_OFFSET); - length = readl(dev->policy_buf + POLICY_COOKIE_LEN); + cookie = *(u32 *)(dev->policy_buf + POLICY_COOKIE_OFFSET); + length = *(u32 *)(dev->policy_buf + POLICY_COOKIE_LEN); if (cookie != POLICY_SIGN_COOKIE || !length) return -EINVAL; From patchwork Tue Feb 27 14:55:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Armin Wolf X-Patchwork-Id: 207257 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp2747062dyb; Tue, 27 Feb 2024 06:55:55 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCXME04G7szDmJvIbadlqocEMXiMjtNZMeTnacka6DAN4sDgvjY7HJdvnlntKz7BANgJjCPAYv8mJQTohL6iRIaDP15MPQ== X-Google-Smtp-Source: AGHT+IGHHj69eoEQKmodvjwYUERvJjM77EVC25NcqnZsv5M+Xq3R7IsgEyj5jnsHwKsI3jtVSTND X-Received: by 2002:a05:6214:3d88:b0:68f:e858:a1e1 with SMTP id om8-20020a0562143d8800b0068fe858a1e1mr4320230qvb.25.1709045754804; Tue, 27 Feb 2024 06:55:54 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1709045754; cv=pass; d=google.com; s=arc-20160816; b=sHkw3svzUQQVletdLrqj9zRqirXmGPQPNBzHSHiJd9sXOsRk5Omc0eNOZGRp5CSn9W IW+ZQsP19P1XGsiOSVVzdC/FGSOl79wJ9Ui3pA1zFcGDdHlKqOn7Vz7jvokFgdz6LwUs nw2P8Tvfl7BWJsItvdMkmjbFQ142XNeuOdr3cOCRg5iyzlhOxKRw7JmXqAiZGvDdRr2S etM0xwDtOF1h/SD8KPr5PoZPtIW/3ogudZvSPAxM8w5Wqg33U9unBYEsIYkXXyNXjt5g mWw557HNgqu7wM5zSf8rpzLJCoZ1/N+L08lXy6pB7G9NpblLCvAKkg92dgsVqCu1JWHl lDuw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=ui-outboundreport:content-transfer-encoding:mime-version :list-unsubscribe:list-subscribe:list-id:precedence:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=6jUL+5ZGtLoopOVO/3uujcO6Ldk69hQdRsWCVfk7qV4=; fh=Iw0cdpf9yN87ufu137c7ThcNR/cLOoX+JIMwqQQfbho=; b=PCBLZxl0YN9liL2szDHlJ7K60Nqm75UQqnkYvzdTxSfOdttsxPWMyvyxm5n198nb3G smdeJDIQF5b1i+gBPwJozZ06+MVTgjAM1yQJiuPmPjtjkCly69SMPdiSRif/6NJIa4oO +u49BCjNuZd87vrbglcEQ99YO/kXHHeBY9ziriydfzSX+35wvK/IDleb8CEeJg+QD/4I YMa4xx0DGODuykRiPkkVByAL4Hx4f1U2/r2JukZEGyIkQW6gjRE5//im/TmIsr6wthnX 66cUYA10whwAMZo2FtrpRdvA/m8u+bikDZHVIU5jHAgnHv9FtCEKQeyyQ411Vkv3q9ho pHYA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@gmx.de header.s=s31663417 header.b=iV49nW+P; arc=pass (i=1 spf=pass spfdomain=gmx.de dkim=pass dkdomain=gmx.de dmarc=pass fromdomain=gmx.de); spf=pass (google.com: domain of linux-kernel+bounces-83436-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-83436-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=gmx.de Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [147.75.199.223]) by mx.google.com with ESMTPS id gi1-20020a056214248100b0069019d45e93si2616719qvb.195.2024.02.27.06.55.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Feb 2024 06:55:54 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-83436-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223; Authentication-Results: mx.google.com; dkim=pass header.i=@gmx.de header.s=s31663417 header.b=iV49nW+P; arc=pass (i=1 spf=pass spfdomain=gmx.de dkim=pass dkdomain=gmx.de dmarc=pass fromdomain=gmx.de); spf=pass (google.com: domain of linux-kernel+bounces-83436-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-83436-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=gmx.de Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 7F62E1C22CAE for ; Tue, 27 Feb 2024 14:55:46 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E11421420A0; Tue, 27 Feb 2024 14:55:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b="iV49nW+P" Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3CCC13B289; Tue, 27 Feb 2024 14:55:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.227.15.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045726; cv=none; b=iBcXdBR7IfXluP2palF86MLFvjcx3jvdRJMA9ODf1DiVOCgfVN1srcksBkl8DzMzX5iYhgyvYlKQIh/KEt1nhT7qxNFnD02QGVYq55jRnV8wudCIr0jTEXR/BGMqKAb0IarbyoRyynTf9yRePuDOCDjZv4vSq2qGz1tqmSTTleY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045726; c=relaxed/simple; bh=fBLBJnTXEesUlwnv6flfi7CtneDxF1nsqo3zSFZ/SCs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=D67rGPOroS/7VtcRpTOZOsu1sz7RtHtzSrVlS+IKuWTnu5ferB9KWQ6PIcqLQAzB+YwJHt5VPdphy4vaNk2M55Irug7xC6XwFm7tuVoi4LWO3UoqI2xB/ck88v1ro7617tXsjAeBM10R3yAbTruRzIHhAfUsqANaz9T1uEmOUso= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de; spf=pass smtp.mailfrom=gmx.de; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b=iV49nW+P; arc=none smtp.client-ip=212.227.15.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.de; s=s31663417; t=1709045708; x=1709650508; i=w_armin@gmx.de; bh=fBLBJnTXEesUlwnv6flfi7CtneDxF1nsqo3zSFZ/SCs=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:In-Reply-To: References; b=iV49nW+PM1NvK+0/Fb5KnrvKctrOzz088gPi78nErBhSlex1JBHymmG9e4ITqitD Gj5N7wEWXWhkYHqHqWj3+oGRDRWtZ2p42J2McAosJkiVb9MhRVT1a5MOYW2Y+7iUk cHm5NzdebPpsrUoW+q7NjgB+VpLy86J/itI8PQsHLdEeSb29XWn6MDBG+LNhRG6TQ SgpRx3wun2SYkmYuWGItwtt+Hlpdjf3DeCPpaqBMxQpHeCxPR+uDA6RorCR4Hy9bw X2I/sb7fOOn4JAAwwWT1xrjmgQkq3qppUWjsIbJI2gWsG8fOck7viHc17uiDwe+sj repCWkx/NSeLGcYWuA== X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a Received: from mx-amd-b650.users.agdsn.de ([141.30.226.129]) by mail.gmx.net (mrgmx005 [212.227.17.190]) with ESMTPSA (Nemesis) id 1Mulm5-1qoFTz26Vv-00rqYP; Tue, 27 Feb 2024 15:55:08 +0100 From: Armin Wolf To: Shyam-sundar.S-k@amd.com Cc: hdegoede@redhat.com, ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/2] platform/x86/amd/pmf: Fix possible out-of-bound memory accesses Date: Tue, 27 Feb 2024 15:55:00 +0100 Message-Id: <20240227145500.299683-2-W_Armin@gmx.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240227145500.299683-1-W_Armin@gmx.de> References: <20240227145500.299683-1-W_Armin@gmx.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:mwB/4+OQxc3beQYvIPV5xzGZIUOShegwwrNBgf2oo3MXenhZKFn bLP7TMzPgdsBYdgMbfx/KV+sy/zk32uwTlQjBeZRJIXYhi5A1ym5YXoBbmabvZb5R+iEMhH ZpB5nX7NBegF/ok7HNjUd5y5eU8tywxrGPW4gq0k33+ZHTV6bZ6RbHdjHzlj3vgo8gWIi6s d9Y/faRB1BIVmDPrv2Zsw== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:zQEp+AMOBAE=;RccVHBJEzxHJeOPYwc5sLut92VT 4zv4X4Yy9b7mGc4eOoSAwV0vzU+2vlT17wh42WWplCbusylS/AoMQI4gFPMm9r1tlFKpMH4cj KoliPSYlRfOzK09yDNcr4BVYgNGAJitXG0jJVNLED5OoWyLBCv8US2bC+QEagXQEGuD2uHJXD kEYT2FhIxs/YT0XQ1GG3dwalo7xqbSeEag27UGKYPpSJdnVbyktyloz3VDfVDHZlRRL19/Lzk KmrNYiBua4wfQ7NvLYI35MG8Y0AkKxmK0b/aQj258qvq1dzub9DYwNCQODXn0ekUhntJy6FXl SII3l6uVYuW042qxHFQ3vBjjlyhCnD46Ch/amn+UBvP1BQF0fNhUH0D27jCBfVTOi02ry/0Oy m/wJiw5ZFo6ju6q1ER7YrygVrWhLsZeCzqpc3OUYNV9qjSyOM/ferF598b5UpteIg8L8zOe71 XmMlADWNMo2x96JmPRAiVl7sTwbCSm0vjzjSRE166YO+cgwhQN4a7wwO8oceBmS4bGUzLY7ZF XZS8nyZJ3uShNWldDXzCBJYvJNEUCINCENB0bjx0GI/XLAS4B1OuqUkgbhvk8ev18EULiUyp4 zEUKdEntPWmYJqsnXb8uNFX8Juamh3KKhQ3/5Dqd1BHkQfBe6LpY147A0n+xZaX0kEcDo6a08 V1fYHsNUHZwpO623W0TIZMzU127Ur3DcMgGevEQTm23N0WhNloakK7MMnbn6AaeZQDdpRgxP0 jXEU6rOLuQHSQL8HXXpyislqhz3PtZkmRi8+bjg9hb/TSLQwhOkA9v0vNu5eDJDZ3mjKdyFS3 n7xWznp81IBYR5mP9/gCMWqg/Rw+VxprF0Z6IfKFaOCnM= X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1792064361253154922 X-GMAIL-MSGID: 1792064361253154922 The length of the policy buffer is not validated before accessing it, which means that multiple out-of-bounds memory accesses can occur. This is especially bad since userspace can load policy binaries over debugfs. Compile-tested only. Signed-off-by: Armin Wolf --- Changes since v1: - check if the policy buffer also has enough room for storing the length --- drivers/platform/x86/amd/pmf/tee-if.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.39.2 diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c index b3491268b6a0..09e3c620a9c7 100644 --- a/drivers/platform/x86/amd/pmf/tee-if.c +++ b/drivers/platform/x86/amd/pmf/tee-if.c @@ -249,12 +249,18 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev) u32 cookie, length; int res; + if (dev->policy_sz < POLICY_COOKIE_LEN + sizeof(length)) + return -EINVAL; + cookie = *(u32 *)(dev->policy_buf + POLICY_COOKIE_OFFSET); length = *(u32 *)(dev->policy_buf + POLICY_COOKIE_LEN); if (cookie != POLICY_SIGN_COOKIE || !length) return -EINVAL; + if (dev->policy_sz < length + 512) + return -EINVAL; + /* Update the actual length */ dev->policy_sz = length + 512; res = amd_pmf_invoke_cmd_init(dev);