[PATCH 1/6] platform/x86/intel/pmt/discovery: Bound attr_size against feature_table capacity

[David E. Box]

The feature header's attr_size field is fully device-controlled (8 bits,
up to 255) and is used to compute the length passed to memcpy_fromio()
when copying attribute fields into struct feature_table. The only
existing bounds check validates this length against the mapped MMIO
source resource (res_size), which is itself sized from another
device-controlled field (disc_tbl->size) and has no relationship to
the fixed destination struct's actual capacity.

A malicious or compromised PMT endpoint can report a large enough
disc_tbl->size (to satisfy the source-side check) together with
attr_size = 0xff, causing memcpy_fromio() to write up to 1020 bytes
into struct feature_table's 16-byte caps/union region, corrupting
adjacent fields (guids, kobj, priv, list, attr_group, id) and
neighboring heap allocations.

Check the attribute payload size against the space from the end of the
header to the end of the union before the copy occurs. Skip a feature
that fails the check rather than failing probe, so one malformed table
does not take down the features that were described correctly.

Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
Assisted-by: LLM
Signed-off-by: David E. Box <david.e.box@xxxxxxxxxxxxxxx>
---
 drivers/platform/x86/intel/pmt/discovery.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/platform/x86/intel/pmt/discovery.c b/drivers/platform/x86/intel/pmt/discovery.c
index f4203d240f54..47a4def6e6b9 100644
--- a/drivers/platform/x86/intel/pmt/discovery.c
+++ b/drivers/platform/x86/intel/pmt/discovery.c
@@ -24,6 +24,7 @@
 #include <linux/overflow.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
+#include <linux/stddef.h>
 #include <linux/string_choices.h>
 #include <linux/sysfs.h>
 #include <linux/types.h>
@@ -38,6 +39,9 @@
 #define DT_TBIR			GENMASK(2, 0)
 #define FEAT_ATTR_SIZE(x)	((x) * sizeof(u32))
 #define PMT_GUID_SIZE(x)	((x) * sizeof(u32))
+/* Space for attribute fields between the header and the guids pointer */
+#define FEAT_ATTR_CAPACITY	(offsetofend(struct feature_table, rmid) - \
+				 sizeof(struct feature_header))
 #define PMT_ACCESS_TYPE_RSVD	0xF
 #define SKIP_FEATURE		1
 
@@ -420,6 +424,18 @@ pmt_feature_get_feature_table(struct pmt_features_priv *priv,
 	header = &feat_tbl->header;
 	memcpy_fromio(header, feat_offset, sizeof(*header));
 
+	/*
+	 * The attribute fields are copied into the fixed caps and union
+	 * fields following the header. Skip, rather than fail on, a feature
+	 * whose attributes don't fit so the remaining features still probe.
+	 */
+	if (FEAT_ATTR_SIZE(header->attr_size) > FEAT_ATTR_CAPACITY) {
+		dev_warn(priv->dev, "Skipping feature %s: bad attr_size %u\n",
+			 pmt_feature_names[feature->id], header->attr_size);
+		devm_iounmap(priv->dev, feat_base);
+		return SKIP_FEATURE;
+	}
+
 	/* Validate fields fit within mapped resource */
 	size = sizeof(*header) + FEAT_ATTR_SIZE(header->attr_size) +
 	       PMT_GUID_SIZE(header->num_guids);
-- 
2.43.0