From nobody Tue Aug 25 16:01:16 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTsvx0xflz6pbqy for ; Tue, 25 Aug 2026 16:01:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTsvw6QJCz44DK for ; Tue, 25 Aug 2026 16:01:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673676; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tZdobzzUp3qSr+hJuLB2uETkSYz9ncj8DoR3w8LOC+k=; b=vTeysVgkB++lFdY2GNk29KjLL+9L4oq9l5ruifv637PVDMDG1jXgzsZfreQTMvNFRkCtgh c7Vv4qXV6zT+ZrKXA96K9YzvuATrpnla9uLTquzayhjoP7bg5s/uTtifBUfh0k0gRC/yhy A5QRZc/FESjFtyGks/1AUSG2Nb9I6S8upGwedRfAlslmAEte4TAHpCyYja9jH86I8hW8mD NGmhqdjwAs9Hc5XbJJKTOA/8deNTdkGu3+02TsaFSU6T0Bew3sus8aFNvu75JsUd/Poyfc FaOcZDnce/72rbyck0vM9vIeEBfNEXL4hYQWbNpleqP09Bw/P+s9qNsJGGOoYQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673676; a=rsa-sha256; cv=none; b=Xmr/5wCVgbd2pqELGWIi4Ii9Sl7p88dugP7XByfGYjIXZG0dypvknTqjpwJr8ixxH7nDW0 lQx5xeIg2UqLSyObsQ98d3FCjaEJ0U3Jof+EFPn9UhdCkQJ18dKxQMsCgSN35nLoGSsoqS MWDrH6STio+jRuQM76iu+m8j5AGzkYY8EAIwKT5Bg7oPbtLD9w7Rxt1D4mbieWYULQcjYy 3UuSfQlOTrln/z3+AxoG+QhfNST+/XNo3SRlLKhnh669OOqG0kEYPZxIV0YH5ybSkWjIgw oH+8j/xg2t23jMeaC8TMr6kwX1ZUtla1B+oXHzbMADXvAgg/VMWYu4K4MRvnMw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673676; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tZdobzzUp3qSr+hJuLB2uETkSYz9ncj8DoR3w8LOC+k=; b=qvuGV8umPZyCuZZ8KUltwm7rjY/aSZJoVkuAMGxzXe2eH1obqOsOf09gxvR+Mm7EMzzI3Q Z8IlvIOdpQnnNdviMnO7gPZ55vzwj0eaKaz6XLP7k/Iuqr1zJZC4LPddtl1e+YqJz3l6IK bA5aC5d54GRYX9dRUbavO9b1NgjxgHp7cbp4UFvCN83TvQo6pdMzSd+dxI7GIWyDfPF+G4 IMIUE7RcIBFUMQry3Fid9KjMihkU5LHKmj5PfPqUiM9wmVwWo/WVX7n7CpmRKWSNg/miP1 ZfH9SEFTziXz4VXD+YE/EnUvBUKGVdOFN2UOnwaGqzq5f9CzCATYHFv/JqZm5Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTsvw5QlBzxtW for ; Tue, 25 Aug 2026 16:01:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 333e4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:01:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: a0e96483e2ce - releng/15.1 - ucode: Fix validation on Intel platforms List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: a0e96483e2ce5b78fa794af6e25104184fa0ee26 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:01:16 +0000 Message-Id: <6a8dbc4c.333e4.2481cd0d@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a0e96483e2ce5b78fa794af6e25104184fa0ee26 commit a0e96483e2ce5b78fa794af6e25104184fa0ee26 Author: Mark Johnston AuthorDate: 2026-05-27 20:18:05 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 19:32:22 +0000 ucode: Fix validation on Intel platforms The check for the extended signature table was backwards, so we always ignored it. We should verify that the extended signature table fits within the total image size. Approved by: so Security: FreeBSD-EN-26:20.microcode Reviewed by: jrm, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57209 (cherry picked from commit 0beb172898499fff51eed4df3d9284cd1094afbb) (cherry picked from commit 2a1eaaf331f7935b3febbb863e1c892670030b8e) --- sys/x86/x86/ucode.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/sys/x86/x86/ucode.c b/sys/x86/x86/ucode.c index 613a7b03489f..37c38c08635a 100644 --- a/sys/x86/x86/ucode.c +++ b/sys/x86/x86/ucode.c @@ -204,7 +204,6 @@ ucode_intel_match(const uint8_t *data, size_t *len) uint64_t platformid; size_t resid; uint32_t data_size, flags, regs[4], sig, total_size; - int i; do_cpuid(1, regs); sig = regs[0]; @@ -226,19 +225,35 @@ ucode_intel_match(const uint8_t *data, size_t *len) if (total_size == 0) total_size = UCODE_INTEL_DEFAULT_DATA_SIZE + sizeof(struct ucode_intel_header); - if (data_size > total_size + sizeof(struct ucode_intel_header)) + + if (total_size > data_size + sizeof(struct ucode_intel_header)) table = (const struct ucode_intel_extsig_table *) ((const uint8_t *)(hdr + 1) + data_size); else table = NULL; - if (hdr->processor_signature == sig) { - if ((hdr->processor_flags & flags) != 0) { - *len = data_size; - return (hdr + 1); + if (hdr->processor_signature == sig && + (hdr->processor_flags & flags) != 0) { + *len = data_size; + return (hdr + 1); + } + if (table != NULL) { + size_t extsize; + + extsize = total_size - + (data_size + sizeof(struct ucode_intel_header)); + if (extsize < sizeof(struct ucode_intel_extsig_table)) { + ucode_error = VERIFICATION_FAILED; + break; } - } else if (table != NULL) { - for (i = 0; i < table->signature_count; i++) { + extsize -= sizeof(struct ucode_intel_extsig_table); + for (uint32_t i = 0; i < table->signature_count; i++) { + if (extsize < sizeof(struct ucode_intel_extsig)) { + ucode_error = VERIFICATION_FAILED; + goto out; + } + extsize -= sizeof(struct ucode_intel_extsig); + entry = &table->entries[i]; if (entry->processor_signature == sig && (entry->processor_flags & flags) != 0) { @@ -248,6 +263,7 @@ ucode_intel_match(const uint8_t *data, size_t *len) } } } +out: return (NULL); }