| From 1b777d4d9e383d2744fc9b3a09af6ec1893c8b1a Mon Sep 17 00:00:00 2001 |
| From: Nick Lopez <github@glowingmonkey.org> |
| Date: Sat, 22 Jan 2022 01:19:06 -0700 |
| Subject: drm/nouveau: fix off by one in BIOS boundary checking |
| |
| From: Nick Lopez <github@glowingmonkey.org> |
| |
| commit 1b777d4d9e383d2744fc9b3a09af6ec1893c8b1a upstream. |
| |
| Bounds checking when parsing init scripts embedded in the BIOS reject |
| access to the last byte. This causes driver initialization to fail on |
| Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working |
| console. |
| |
| This is probably only seen on OpenFirmware machines like PowerPC Macs |
| because the BIOS image provided by OF is only the used parts of the ROM, |
| not a power-of-two blocks read from PCI directly so PCs always have |
| empty bytes at the end that are never accessed. |
| |
| Signed-off-by: Nick Lopez <github@glowingmonkey.org> |
| Fixes: 4d4e9907ff572 ("drm/nouveau/bios: guard against out-of-bounds accesses to image") |
| Cc: <stable@vger.kernel.org> # v4.10+ |
| Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu> |
| Reviewed-by: Karol Herbst <kherbst@redhat.com> |
| Signed-off-by: Karol Herbst <kherbst@redhat.com> |
| Link: https://patchwork.freedesktop.org/patch/msgid/20220122081906.2633061-1-github@glowingmonkey.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c |
| +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c |
| @@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 |
| *addr += bios->imaged_addr; |
| } |
| |
| - if (unlikely(*addr + size >= bios->size)) { |
| + if (unlikely(*addr + size > bios->size)) { |
| nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr); |
| return false; |
| } |
