From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-235.mail.qq.com (out203-205-221-235.mail.qq.com [203.205.221.235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0806D28F5 for ; Sun, 21 Jun 2026 00:20:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.235 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782001247; cv=none; b=UtH7JeQM8r9wqHUF8+yn+7zk5WMYYeR0Nf1g3IjYgUQuaCG6715X8x0LL9j6eGjGZaUvGbHYnqtGJLpxtehyDkGRqms3JlSOEslHjJYHgWUOou/h42OpnQWsLT03h5JgODv/UuaPr01J1JaOQ55pY6eQ5q/fKF3UG2f8CvJ9y7c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782001247; c=relaxed/simple; bh=MCEJvJPpZTCkDt2kURCqwRvWxbgV7ALpFILMrcWAGmI=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=h85NFFObwVxGmyf1NA2icCu23cn2Fq7I+46T2SwGYEvVFwa2fwY/FJUgp87tQ62bRuYolfBVY0bSSVJgbC4xPsZKZ42perlc2tGr+mfIRbjOQLZKsJWTNPkH2h1AR3sqMcoPHXgbavQLez7sPiuXSSji5zBiAVGo0n/CLdn+U5g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=mn09JwNY; arc=none smtp.client-ip=203.205.221.235 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="mn09JwNY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1782001237; bh=F8katiYvY03WU8JehbFkt3bV3yAiHohFT974wHM7/fg=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=mn09JwNYil37umsNgtTfodrMzxHPe3fJOZRJ1N3hEpFNPVMrUeCbG1fHNWwdzbG+l c/gljWSSxjGVLQEFNjLZLj0WvWwmjGSpHdVS/b4rbdKKyNagN+uAhZmXhKV2Aj0HqZ nutEtwKXF84+khsSn635HHvJLbPUQThfxExPi9kw= Received: from [192.168.1.100] ([218.106.117.236]) by newxmesmtplogicsvrsza73-0.qq.com (NewEsmtp) with SMTP id 4D51523B; Sun, 21 Jun 2026 08:19:21 +0800 X-QQ-mid: xmsmtpt1782001161t2pvdre5i Message-ID: X-QQ-XMAILINFO: OATpkVjS499uxI34GXLNkedAWBFtEX/aha2TKjVNXQTBRsPOMvCf78zyRVSDAs b/0msYty5jfFqdaFwG4pxJFSLUm+Dt9GvcQsGA8Qq8TjOsfDEmWtERL11oZHf7df+1HFeZ94e7qH 4qg3qxESeeuJCbdawLTdKjxabvA+y/u7cdtUlbyg32PiQudkE3aKeWFcE8kc2vqN3UtFmZ6kUQPX foKDHaQo/0Ci6SX4s1AYOWCpAXHTmrYDPYJi/jqTMM1uMbXDL3GUFOIS6XLo/a1YXk5qdm0iSjoQ JKrTDEBgAbUUddsdfNF9y4yweBFTRDmSRaY2dtN766ZuI838Rk54wUmq1Gy30Q1XLQkc/ceEGj2Q EPQGcbbUihTZA5dtlbBov0zbVdPSu15bNL09Tg2pwGFFKLj2eKZLOp/f9U3WfWTu65xMsRfWa0qF wAf3pvgp5hmpxKcD1cxFOTL6q7h4F8Mh6yhJN7JBEjkageJGdYgGICZtkWWcYLNOG/PMcl3ODyPl 7f46cPg5jrAni5R1dwenseDaxo7t0tyIXACgAGGIcTmctJiAuX+gqmfrd8ixAbJqSL1CMsofUfCh lCSlmxRpTMy3qpVuXBIVBIWPSRq8SZPno9FCX2mF/63wseoKWbZac6rphyWFhWzJRF7ZhJ1W89lB B7ytnDagoyk0SaDBG2LwVPhUQXH2yy2Z0pRD/DRbcrePF3oJv+qJV/c4BhPTpkzASe7ya6sE+qN2 GqD99r7X4ouUpnRG2m7Psj2kx23Y8+tIGX232ve6M/u93YuA1CCUFHr9exsxfZPgzOD25xD4olba sOk0TDnk4S9TCBKFlOCyumFlryRDgY/ChTbho8Cdn+IU9LYdtLgYj16lgw86TULGWeDUhqCE4y49 1EimTSgHh5xhZpNEcCJ3x+6Hs5qpkuX3ez1Za5j7OvS3gd3iQXdrmmuGyJgy7adOs72IgT67hMci mu1GchEF7FiGnu2HLe+22DOwjs+gwyE/tFeOv6tah3Q1y44++1wv+qFNGo35SOAvQyMMhNa/jlqw luQW8p5RetAxpxJZCwfhmwLMbB0nJRRI4RJB6LmEwjPIm0PPtmyc+1gmmfafj4Iwy7kt6ZKAmhos fBcRZqCUmGRT/W3cxZM6qwjPcqhL1FnzbKUc4PLRVf0KzsDhw9uuE8OaUFaQ== X-QQ-XMRINFO: OWPUhxQsoeAVwkVaQIEGSKwwgKCxK/fD5g== X-OQ-MSGID: Date: Sun, 21 Jun 2026 08:19:20 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 5/7] x86/microcode/hygon: Add microcode loading support for Hygon processors To: Fu Hao , tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com Cc: linux-kernel@vger.kernel.org, tingyin.duan@gmail.com References: From: XIAO WU In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Fu Hao, I came across a Sashiko AI code review [1] that flagged a potential out-of-bounds read in `parse_and_cache_patches()` in the new Hygon microcode loader.  I was able to reproduce it in QEMU with KASAN enabled.  The trigger is simple: feed a firmware container that has only an equivalence table (no patch sections), and the subsequent `hygon_section_hdr()` call reads past the buffer end. On Tue, Jun 16, 2026 at 12:05:29AM +0800, Fu Hao wrote: > Add support for loading Hygon microcode. ... > +static enum ucode_state parse_and_cache_patches(u8 family, const u8 *data, size_t size) > +{ > +    u8 *fw = (u8 *)data; > +    size_t offset; > + > +    offset = load_equiv_cpu_table(data, size); > +    if (!offset) > +        return UCODE_ERROR; > + > +    fw   += offset; > +    size -= offset; > + > +    if (hygon_section_hdr(fw, TYPE) != UCODE_UCODE_TYPE) { If the container has only an equivalence table and no patch sections, `load_equiv_cpu_table()` returns an offset equal to the total buffer size.  Then `size -= offset` makes `size == 0`, and `fw` points past the buffer.  The call to `hygon_section_hdr(fw, TYPE)` then reads a 4-byte section type field from beyond the buffer boundary. [Reproduction] I rebuilt the kernel with CONFIG_CPU_SUP_HYGON=y and CONFIG_KASAN=y, and added a /proc/hygon_poc entry that calls parse_and_cache_patches() with a crafted firmware blob containing only an equivalence table (zero patch sections).  Writing any value to /proc/hygon_poc triggers the path. PoC source (poc.c): ---8<---------------------------------------------------------------- /*  * PoC: OOB read in parse_and_cache_patches() in hygon.c  * Trigger: echo X > /proc/hygon_poc (or run this binary)  */ #include #include #include #include int main(void) {     int fd = open("/proc/hygon_poc", O_WRONLY);     if (fd < 0) { perror("open"); return 1; }     write(fd, "X", 1);     close(fd);     printf("Done. Check dmesg.\n");     return 0; } ---8<---------------------------------------------------------------- Compile: gcc -o poc poc.c -static [KASAN report — kernel 6.19.0-rc5, CONFIG_KASAN=y]   ==================================================================   BUG: KASAN: stack-out-of-bounds in parse_and_cache_patches.isra.0+0x805/0x8e0   Read of size 4 at addr ffffc9002106fc74 by task poc/9404   CPU: 1 PID: 9404 Comm: poc Tainted: G  W 6.19.0-rc5-gd3caa0b6e4ac-dirty #2   Call Trace:        dump_stack_lvl+0x116/0x1f0    print_report+0xcd/0x630    kasan_report+0xe0/0x110    parse_and_cache_patches.isra.0+0x805/0x8e0    hygon_poc_write+0x97/0xd0    proc_reg_write+0x245/0x340    vfs_write+0x2a5/0x11e0    ksys_write+0x12f/0x250    do_syscall_64+0xcd/0xf80    entry_SYSCALL_64_after_hwframe+0x77/0x7f   The buggy address belongs to stack of task poc/9404    and is located at offset 52 in frame:    hygon_poc_write+0x0/0xd0    This frame has 1 object: [32, 52) 'test_hdr' The crash is at `parse_and_cache_patches+0x805`, which corresponds to the `hygon_section_hdr(fw, TYPE)` call reading the section type from beyond the buffer.  The stack object `test_hdr` at [32, 52) has size 20 bytes — the OOB read at offset 52 is exactly at the boundary. [Suggested fix] Add a bounds check before reading the section header:   offset = load_equiv_cpu_table(data, size);   if (!offset)       return UCODE_ERROR;   fw   += offset;   size -= offset; + if (size < HYGON_SECTION_HDR_SIZE) { +     pr_err("no patch sections in container\n"); +     return UCODE_ERROR; + } +   if (hygon_section_hdr(fw, TYPE) != UCODE_UCODE_TYPE) { This mirrors the pattern used in the AMD loader (parse_container() in amd.c), which checks `size < 0` before accessing section headers. The review also notes that `kzalloc_obj` in `try_verify_and_cache_patch()` does not appear to be a defined kernel macro, and `hypervisor_present` may not be declared — these are build-time issues separate from the runtime OOB above. [1] https://sashiko.dev/#/patchset/cover.1781523812.git.fuhao%40open-hieco.net     (Sashiko AI code review — "Out-of-Bounds Access", Severity: High) Thanks, XIAOWU