From nobody Tue Jul 14 14:56:07 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h02S767HTz6kqgs for ; Tue, 14 Jul 2026 14:56:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h02S75Xdpz3Lff for ; Tue, 14 Jul 2026 14:56:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784040967; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uoFXaaaP2Zi97RnQuBrDuKrR8JPDD/IKrP4OFzlPLKs=; b=hbTceAyvNeJuF6tAwcAyhsmrFCBHrF9nkx3DVkGSlsU4DjaFaJmMGpSIBoH7PNUXdZoNa7 D4I6xlCk9uMtTOl0xV7EGJiA0vQbvAhyXmAMeAUdfLr9FlJzsJPBG8xcj7DD5IQvcGMZ3w uvTyoQtPirwjKrvEiru2h0j3kdZscWw8fkyvCPI5KT2butsGGqYF6rOJHi05J5arLMuHx/ xeNPNm7UKqQ66BadIiRZisgOKr/aj+jdJZV9I/jfrA8+gqAuTqogDl4Q1pSQEvKt9Ls6JT ugT3Ut8TUVDxMooStxrOl1S+V9ylqC+vDNRS004ay9XYXa3nBc5YFQehyZF+wg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784040967; a=rsa-sha256; cv=none; b=SOjHsNsPSweKPgtDHA1tFUqWvoOVZJ/xlkHHjWrrbuBUnsoqV3Jhq7upzuttWTPuIYLdoJ K9pF9i4XPhvcTECUeS+S8sr1ns0WqGb8GaU9TbVSyRLlQKdVWx5RKpg92hNvzWO/1eoUSm e5vtrmzeAZ6GpnMq4lZjYJlDgRDo/sSk19Bkzlf6vtyAHF2wqoq5JcK8vre2wFvmGeukUC qKyNBHMV512LRzhWeH23yqv69PkNNV1YY2twPrdrVkP0uSxUbHr5SDFuvCFyAjuA57ZfQj uM7G3WalcmCF7wMBVcu66u9DaAcP11S1z8+C6W2ZZ7H7GHmL6EgEfjnGtIOakQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784040967; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uoFXaaaP2Zi97RnQuBrDuKrR8JPDD/IKrP4OFzlPLKs=; b=a53hf7DvZsITGTxxWSY7Jut4FmtpjLEo6V9LdxiAErbVixdAMLCLT2xKCOP3N9qKiFGWm0 fvthW4yrsHaZAODAmqRUxfxM3NIky9D6sGXS903H7AGGw6eiDFzANgkMrsKoYg9SpCfi/g SshNkDJDYNHiG7WvnsSDoBbuTub7Sg2/4H131s3aTYM85TkeeSMQrVVk/H0zeZnJddMeya DOoaL5WkwEA83bdNb44WPPH2pxtJ4KJolF81uQgZehrso8XGmLtab1r/q3vA1gGIldSfu9 TLPm4u49IwcCX+QMO6LyPoQFiNtbmq41lFbZV4NuWzKy6rboKQUhJEzCc5NPKg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h02S74J5kzqJ3 for ; Tue, 14 Jul 2026 14:56:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b3de by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 14 Jul 2026 14:56:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 38cbd2588f0b - stable/14 - ucode: Fix validation on Intel platforms List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 38cbd2588f0b6f677f42287af425ac913da46294 Auto-Submitted: auto-generated Date: Tue, 14 Jul 2026 14:56:07 +0000 Message-Id: <6a564e07.3b3de.6ce63759@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=38cbd2588f0b6f677f42287af425ac913da46294 commit 38cbd2588f0b6f677f42287af425ac913da46294 Author: Mark Johnston AuthorDate: 2026-05-27 20:18:05 +0000 Commit: Mark Johnston CommitDate: 2026-07-14 13:02:07 +0000 ucode: Fix validation on Intel platforms The check for the extended signature table was backwards, so we always ignored it. We should verify that the extended signature table fits within the total image size. Reviewed by: jrm, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57209 (cherry picked from commit 0beb172898499fff51eed4df3d9284cd1094afbb) --- sys/x86/x86/ucode.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/sys/x86/x86/ucode.c b/sys/x86/x86/ucode.c index 298ce5448853..9233e9fa93a8 100644 --- a/sys/x86/x86/ucode.c +++ b/sys/x86/x86/ucode.c @@ -179,7 +179,6 @@ ucode_intel_match(const uint8_t *data, size_t *len) uint64_t platformid; size_t resid; uint32_t data_size, flags, regs[4], sig, total_size; - int i; do_cpuid(1, regs); sig = regs[0]; @@ -201,19 +200,35 @@ ucode_intel_match(const uint8_t *data, size_t *len) if (total_size == 0) total_size = UCODE_INTEL_DEFAULT_DATA_SIZE + sizeof(struct ucode_intel_header); - if (data_size > total_size + sizeof(struct ucode_intel_header)) + + if (total_size > data_size + sizeof(struct ucode_intel_header)) table = (const struct ucode_intel_extsig_table *) ((const uint8_t *)(hdr + 1) + data_size); else table = NULL; - if (hdr->processor_signature == sig) { - if ((hdr->processor_flags & flags) != 0) { - *len = data_size; - return (hdr + 1); + if (hdr->processor_signature == sig && + (hdr->processor_flags & flags) != 0) { + *len = data_size; + return (hdr + 1); + } + if (table != NULL) { + size_t extsize; + + extsize = total_size - + (data_size + sizeof(struct ucode_intel_header)); + if (extsize < sizeof(struct ucode_intel_extsig_table)) { + ucode_error = VERIFICATION_FAILED; + break; } - } else if (table != NULL) { - for (i = 0; i < table->signature_count; i++) { + extsize -= sizeof(struct ucode_intel_extsig_table); + for (uint32_t i = 0; i < table->signature_count; i++) { + if (extsize < sizeof(struct ucode_intel_extsig)) { + ucode_error = VERIFICATION_FAILED; + goto out; + } + extsize -= sizeof(struct ucode_intel_extsig); + entry = &table->entries[i]; if (entry->processor_signature == sig && (entry->processor_flags & flags) != 0) { @@ -223,6 +238,7 @@ ucode_intel_match(const uint8_t *data, size_t *len) } } } +out: return (NULL); }