Project

General

Profile

Actions

Bug #15003

closed

Corrupt AMD microcode equivalence-table not properly handled

Added by Andy Fiddaman over 1 year ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Difficulty:
Bite-size
Tags:
Gerrit CR:
External Bug:

Description

There are two bugs in the handling of the AMD CPU microcode equivalence-table where the kernel assumes that is properly formed. Specifically that its size is a multiple of sizeof (ucode_eqtbl_amd_t), and that ends with 16 zero bytes. If either of these are not true, the kernel can read off the end of the memory it allocated to hold the table.

Actions #1

Updated by Andy Fiddaman over 1 year ago

  • Subject changed from Corrupt AMD microcode equivalence-table file not properly handled to Corrupt AMD microcode equivalence-table not properly handled
Actions #2

Updated by Electric Monk over 1 year ago

  • Gerrit CR set to 2389
Actions #3

Updated by Andy Fiddaman over 1 year ago

I've tested that AMD microcode update still works on a number of machines, including:

  • x86 (AuthenticAMD 830F10 family 23 model 49 step 0 clock 3000 MHz)
    AMD EPYC 7302 16-Core Processor [ Socket: SP3 ]
  • x86 (AuthenticAMD A00F11 family 25 model 1 step 1 clock 2650 MHz)
    AMD EPYC 7413 24-Core Processor
  • x86 (AuthenticAMD A00F11 family 25 model 1 step 1 clock 2000 MHz)
    AMD EPYC 7713P 64-Core Processor [ Socket: SP3 ]

I also used some deliberately corrupt equivalence-table files which previously caused the kernel to walk off the end of the struct and confirmed that they now result in it reporting that there is no firmware available.

Actions #4

Updated by Electric Monk over 1 year ago

  • Status changed from In Progress to Closed
  • % Done changed from 0 to 100

git commit dd03b475cb030673a110ddade24162f09801d116

commit  dd03b475cb030673a110ddade24162f09801d116
Author: Andy Fiddaman <illumos@fiddaman.net>
Date:   2022-10-06T11:44:57.000Z

    14991 Large AMD microcode does not load at boot
    14994 Panic on microcode update with UFS boot archive
    14995 misleading messages on microcode update failure
    14996 Restructure ucode data Makefiles
    15003 Corrupt AMD microcode equivalence-table not properly handled
    Reviewed by: Keith M Wesolowski <wesolows@oxide.computer>
    Reviewed by: Marco van Wieringen <mvw@planets.elm.net>
    Approved by: Dan McDonald <danmcd@mnx.io>

Actions

Also available in: Atom PDF