OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices 

Before reading the Extended Size field, we should ensure it fits in
the DMI record. There is already a record length check but it does
not cover that field.

It would take a seriously corrupted DMI table to hit that bug, so no
need to worry, but we should still fix it.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: 6deae96b42 ("firmware, DMI: Add function to look up a handle and return DIMM size")
Cc: Tony Luck <tony.luck@intel.com>
Cc: Borislav Petkov <bp@suse.de>
This commit is contained in:
Jean Delvare 2019-10-14 21:41:24 +02:00
parent 4d856f72c1
commit 81dde26de9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/firmware/dmi_scan.c
View File

@ -408,7 +408,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
bytes = ~0ull; bytes = ~0ull;
else if (size & 0x8000) else if (size & 0x8000)
bytes = (u64)(size & 0x7fff) << 10; bytes = (u64)(size & 0x7fff) << 10;
else if (size != 0x7fff) else if (size != 0x7fff || dm->length < 0x20)
bytes = (u64)size << 20; bytes = (u64)size << 20;
else else
bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20; bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;