From nobody Sun Sep 06 01:20:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hcspf1Rhcz6rRWx for ; Sun, 06 Sep 2026 01:20:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hcspd5SNSz3PXS for ; Sun, 06 Sep 2026 01:20:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788657657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OjuD7ROQ+jYTRP500ajpypR0HeZLJ37t/BHhOnL0ers=; b=xV3UMZZCnH2BYik2kGmuaUp+gsKDU3WPi9octEkixAMCCTx9ykdtuZBNGCyKi9L+g3LmZa D4IJ8msePuQAzzsalD21eDzX0O3XHFTfU8OjmYecqMa6QlqY3LSIM+7WjhpwWgTlkx2qxl WE1rfIZ7gwVNuHSjhUeRWlQr6a92TZa7/lyAJsda1Y+efxBYxUroi5AelUjW3xiasD6yqg qroxX+utXFc8yxz0/r83vwh8qXutbDmAb+q8ouY9ksLiGMxnkWLecHm0d1lgp9c/MgQSE4 F2emw52WvB91Z1PowT44NhXp1OUI1e4gTZU3s5JrXI1rl9HiPZWNH/T4Nyx09A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788657657; a=rsa-sha256; cv=none; b=wx3hjRqugntQ8pWMLNyxdT25Hvpv3nsFcmebDas+TIK6WdTAFzPBULS3/szugxedxHvfNH 4Ca6XYGF576jmiQ8sWScjOdOIdMi83RPkb2kE8payaJE+YL1YwI12wUBp1tC9GAk3JpMFP Ixo5GYmUS2il0cC7sHoTdyU2ZDTi6dxn4t3/LOLJNelZapnMbsbzPaThWCs11kizn6H3CE kda+FyGE6KdoTSpQFu2EpnSkZ368e8SDL9d7ymWkwOR7wBReYKD5WBpfvcfban9KYKY4mw f6VF87IhAObZ9fAasS5o0jTQ5XYUkOcN6s5E4LgSR4vjgJV69ntQw1HZQqJoPA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788657657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OjuD7ROQ+jYTRP500ajpypR0HeZLJ37t/BHhOnL0ers=; b=ippKfJqZi0udJnmynUjwsLfuZrQl3V31NFH5B7dMskA3w7c6NO+uApdnKbyA9MipcycyJa +qmZ10YpK86OuVDG5VEQboFZ0EZni2Ttsb2K2QZwEjBKvlTZl7U5eUksx5oyclzzAUE2C4 qa66dMYy9Vv/mzKGSFke8B6PNc2VIlJ4Vv/heLdfIDzLa+2W7wMpRhJrPFlQ8xl8myIcyd Lp0hTFKRI3zOpVQYNYqTQlhRtVCb6czPABDUEgWfSjgO0SQRmSyjTfj/tLPlASWirAlMww N9/w6e2u/N8EM30doPb3kB7K1PDBXSyVH87A42RfYR9jH6ARnlcSzFMwtl443g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hcspd35Cbz18Nx for ; Sun, 06 Sep 2026 01:20:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 369a9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 06 Sep 2026 01:20:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kevin Bowling Subject: git: 792307d8c31a - stable/15 - amd_iommu: Bound IVHD device-entry parsing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 792307d8c31aae4e1fe2be945561d64f0d38e6bb Auto-Submitted: auto-generated Date: Sun, 06 Sep 2026 01:20:57 +0000 Message-Id: <6a9cbff9.369a9.c9d1265@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=792307d8c31aae4e1fe2be945561d64f0d38e6bb commit 792307d8c31aae4e1fe2be945561d64f0d38e6bb Author: Kevin Bowling AuthorDate: 2026-08-06 08:22:37 +0000 Commit: Kevin Bowling CommitDate: 2026-09-06 01:20:42 +0000 amd_iommu: Bound IVHD device-entry parsing Validate the IVRS table and every subtable length before using either to form iterator bounds. Reject truncated typed IVHD blocks instead of passing them to a type-specific callback. Within each IVHD payload, correct the lower-bound comparison for extended range entries and validate fixed-size entries, paired range terminators, the fixed HID body, and the variable HID UID before dereferencing or advancing. Malformed firmware can no longer drive either iterator beyond its enclosing object. Reviewed by: kib Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D58724 (cherry picked from commit 4a2494d76ad03c755f2cb0ed5e1311b03bb2a8e2) --- sys/x86/iommu/amd_drv.c | 132 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 99 insertions(+), 33 deletions(-) diff --git a/sys/x86/iommu/amd_drv.c b/sys/x86/iommu/amd_drv.c index f2a9bc518201..3a8c1cab7353 100644 --- a/sys/x86/iommu/amd_drv.c +++ b/sys/x86/iommu/amd_drv.c @@ -91,9 +91,14 @@ amdiommu_ivrs_iterate_tbl_typed(amdiommu_itercc_t iter, void *arg, int type, ACPI_TABLE_IVRS *ivrs_tbl) { char *ptr, *ptrend; + size_t min_length, remaining; bool done; done = false; + if (ivrs_tbl->Header.Length < sizeof(*ivrs_tbl)) { + printf("amdiommu_iterate_tbl: truncated IVRS table\n"); + return (done); + } ptr = (char *)ivrs_tbl + sizeof(*ivrs_tbl); ptrend = (char *)ivrs_tbl + ivrs_tbl->Header.Length; for (;;) { @@ -101,18 +106,42 @@ amdiommu_ivrs_iterate_tbl_typed(amdiommu_itercc_t iter, void *arg, if (ptr >= ptrend) break; + remaining = ptrend - ptr; + if (remaining < sizeof(*ivrsh)) { + printf("amdiommu_iterate_tbl: truncated IVRS subtable header\n"); + break; + } ivrsh = (ACPI_IVRS_HEADER *)ptr; - if (ivrsh->Length <= 0) { + if (ivrsh->Length < sizeof(*ivrsh) || + ivrsh->Length > remaining) { printf("amdiommu_iterate_tbl: corrupted IVRS table, " - "length %d\n", ivrsh->Length); + "subtable length %u, remaining %zu\n", + ivrsh->Length, remaining); break; } - ptr += ivrsh->Length; - if (ivrsh->Type == type) { + switch (ivrsh->Type) { + case ACPI_IVRS_TYPE_HARDWARE2: + case ACPI_IVRS_TYPE_HARDWARE3: + min_length = sizeof(ACPI_IVRS_HARDWARE2); + break; + case ACPI_IVRS_TYPE_HARDWARE1: + min_length = sizeof(ACPI_IVRS_HARDWARE1); + break; + default: + min_length = sizeof(ACPI_IVRS_HEADER); + break; + } + if (ivrsh->Length < min_length) { + printf("amdiommu_iterate_tbl: truncated IVRS " + "subtable type %#x\n", ivrsh->Type); + break; + } + if (ivrsh->Type == type) { done = iter((void *)ivrsh, arg); if (done) break; } + ptr += ivrsh->Length; } return (done); } @@ -657,32 +686,43 @@ amdiommu_find_unit_scan_ivrs(ACPI_IVRS_DE_HEADER *d, size_t tlen, struct ivhd_find_unit *ifu) { char *db, *de; + size_t remaining; size_t len; - for (de = (char *)d + tlen; (char *)d < de; - d = (ACPI_IVRS_DE_HEADER *)(db + len)) { - db = (char *)d; + db = (char *)d; + de = db + tlen; + while (db < de) { + remaining = de - db; + d = (ACPI_IVRS_DE_HEADER *)db; + if (remaining < sizeof(*d)) { + printf("amdiommu: truncated IVRS device entry header\n"); + return (false); + } + if (d->Type == ACPI_IVRS_TYPE_PAD4) { len = sizeof(ACPI_IVRS_DEVICE4); } else if (d->Type == ACPI_IVRS_TYPE_ALL) { ACPI_IVRS_DEVICE4 *d4; - d4 = (ACPI_IVRS_DEVICE4 *)db; len = sizeof(*d4); + d4 = (ACPI_IVRS_DEVICE4 *)db; ifu->dte = d4->Header.DataSetting; } else if (d->Type == ACPI_IVRS_TYPE_SELECT) { ACPI_IVRS_DEVICE4 *d4; + len = sizeof(*d4); d4 = (ACPI_IVRS_DEVICE4 *)db; if (d4->Header.Id == ifu->rid) { ifu->dte = d4->Header.DataSetting; ifu->rid_real = ifu->rid; return (true); } - len = sizeof(*d4); } else if (d->Type == ACPI_IVRS_TYPE_START) { ACPI_IVRS_DEVICE4 *d4, *d4n; + len = 2 * sizeof(*d4); + if (len > remaining) + goto truncated; d4 = (ACPI_IVRS_DEVICE4 *)db; d4n = d4 + 1; if (d4n->Header.Type != ACPI_IVRS_TYPE_END) { @@ -696,23 +736,29 @@ amdiommu_find_unit_scan_ivrs(ACPI_IVRS_DE_HEADER *d, size_t tlen, ifu->rid_real = ifu->rid; return (true); } - len = 2 * sizeof(*d4); } else if (d->Type == ACPI_IVRS_TYPE_PAD8) { len = sizeof(ACPI_IVRS_DEVICE8A); + if (len > remaining) + goto truncated; } else if (d->Type == ACPI_IVRS_TYPE_ALIAS_SELECT) { ACPI_IVRS_DEVICE8A *d8a; + len = sizeof(*d8a); + if (len > remaining) + goto truncated; d8a = (ACPI_IVRS_DEVICE8A *)db; if (d8a->Header.Id == ifu->rid) { ifu->dte = d8a->Header.DataSetting; ifu->rid_real = d8a->UsedId; return (true); } - len = sizeof(*d8a); } else if (d->Type == ACPI_IVRS_TYPE_ALIAS_START) { ACPI_IVRS_DEVICE8A *d8a; ACPI_IVRS_DEVICE4 *d4; + len = sizeof(*d8a) + sizeof(*d4); + if (len > remaining) + goto truncated; d8a = (ACPI_IVRS_DEVICE8A *)db; d4 = (ACPI_IVRS_DEVICE4 *)(d8a + 1); if (d4->Header.Type != ACPI_IVRS_TYPE_END) { @@ -726,10 +772,12 @@ amdiommu_find_unit_scan_ivrs(ACPI_IVRS_DE_HEADER *d, size_t tlen, ifu->rid_real = d8a->UsedId; return (true); } - len = sizeof(*d8a) + sizeof(*d4); } else if (d->Type == ACPI_IVRS_TYPE_EXT_SELECT) { ACPI_IVRS_DEVICE8B *d8b; + len = sizeof(*d8b); + if (len > remaining) + goto truncated; d8b = (ACPI_IVRS_DEVICE8B *)db; if (d8b->Header.Id == ifu->rid) { ifu->dte = d8b->Header.DataSetting; @@ -737,11 +785,13 @@ amdiommu_find_unit_scan_ivrs(ACPI_IVRS_DE_HEADER *d, size_t tlen, ifu->edte = d8b->ExtendedData; return (true); } - len = sizeof(*d8b); } else if (d->Type == ACPI_IVRS_TYPE_EXT_START) { ACPI_IVRS_DEVICE8B *d8b; ACPI_IVRS_DEVICE4 *d4; + len = sizeof(*d8b) + sizeof(*d4); + if (len > remaining) + goto truncated; d8b = (ACPI_IVRS_DEVICE8B *)db; d4 = (ACPI_IVRS_DEVICE4 *)(db + sizeof(*d8b)); if (d4->Header.Type != ACPI_IVRS_TYPE_END) { @@ -749,17 +799,19 @@ amdiommu_find_unit_scan_ivrs(ACPI_IVRS_DE_HEADER *d, size_t tlen, "(%#x)\n", d4->Header.Type); return (false); } - if (d8b->Header.Id >= ifu->rid && + if (d8b->Header.Id <= ifu->rid && ifu->rid <= d4->Header.Id) { ifu->dte = d8b->Header.DataSetting; ifu->rid_real = ifu->rid; ifu->edte = d8b->ExtendedData; return (true); } - len = sizeof(*d8b) + sizeof(*d4); } else if (d->Type == ACPI_IVRS_TYPE_SPECIAL) { ACPI_IVRS_DEVICE8C *d8c; + len = sizeof(*d8c); + if (len > remaining) + goto truncated; d8c = (ACPI_IVRS_DEVICE8C *)db; if (((ifu->type == IFU_DEV_IOAPIC && d8c->Variety == ACPI_IVHD_IOAPIC) || @@ -770,31 +822,39 @@ amdiommu_find_unit_scan_ivrs(ACPI_IVRS_DE_HEADER *d, size_t tlen, ifu->rid_real = d8c->UsedId; return (true); } - len = sizeof(*d8c); } else if (d->Type == ACPI_IVRS_TYPE_HID) { ACPI_IVRS_DEVICE_HID *dh; + len = sizeof(*dh); + if (len > remaining) { + printf("amdiommu: truncated IVRS HID entry\n"); + return (false); + } dh = (ACPI_IVRS_DEVICE_HID *)db; - len = sizeof(*dh) + dh->UidLength; - /* XXXKIB */ - } else { -#if 0 - printf("amdiommu: unknown IVRS device entry type %#x\n", - d->Type); -#endif - if (d->Type <= 63) - len = sizeof(ACPI_IVRS_DEVICE4); - else if (d->Type <= 127) - len = sizeof(ACPI_IVRS_DEVICE8A); - else { - printf("amdiommu: abort, cannot " - "advance iterator, item type %#x\n", - d->Type); + if (dh->UidLength > remaining - len) { + printf("amdiommu: truncated IVRS HID UID\n"); return (false); } + len += dh->UidLength; + /* XXXKIB */ + } else if (d->Type <= 63) { + len = sizeof(ACPI_IVRS_DEVICE4); + } else if (d->Type <= 127) { + len = sizeof(ACPI_IVRS_DEVICE8A); + if (len > remaining) + goto truncated; + } else { + printf("amdiommu: abort, cannot advance iterator, " + "item type %#x\n", d->Type); + return (false); } + db += len; } return (false); + +truncated: + printf("amdiommu: truncated IVRS device entry %#x\n", d->Type); + return (false); } static bool @@ -810,8 +870,11 @@ amdiommu_find_unit_scan_0x11(ACPI_IVRS_HARDWARE2 *ivrs, void *arg) if (ifu->domain != ivrs->PciSegmentGroup) return (false); + if (ivrs->Header.Length < sizeof(*ivrs)) + return (false); d = (ACPI_IVRS_DE_HEADER *)(ivrs + 1); - res = amdiommu_find_unit_scan_ivrs(d, ivrs->Header.Length, ifu); + res = amdiommu_find_unit_scan_ivrs(d, + ivrs->Header.Length - sizeof(*ivrs), ifu); if (res) ifu->device_id = ivrs->Header.DeviceId; return (res); @@ -829,8 +892,11 @@ amdiommu_find_unit_scan_0x10(ACPI_IVRS_HARDWARE1 *ivrs, void *arg) if (ifu->domain != ivrs->PciSegmentGroup) return (false); + if (ivrs->Header.Length < sizeof(*ivrs)) + return (false); d = (ACPI_IVRS_DE_HEADER *)(ivrs + 1); - res = amdiommu_find_unit_scan_ivrs(d, ivrs->Header.Length, ifu); + res = amdiommu_find_unit_scan_ivrs(d, + ivrs->Header.Length - sizeof(*ivrs), ifu); if (res) ifu->device_id = ivrs->Header.DeviceId; return (res);