diff options
| author | Jean Delvare <jdelvare@suse.de> | 2019-10-14 21:41:24 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-27 14:51:19 +0100 |
| commit | b79d380017d1d23b1b07c860a1adc1360a1fcb09 (patch) | |
| tree | 840b0637302f5ef85c5fa46d3975d8be0b099b3f /drivers/firmware | |
| parent | fc7510d80220bb0a458c328ace6be44abbf42c35 (diff) | |
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
[ Upstream commit 81dde26de9c08bb04c4962a15608778aaffb3cf9 ]
Before reading the Extended Size field, we should ensure it fits in
the DMI record. There is already a record length check but it does
not cover that field.
It would take a seriously corrupted DMI table to hit that bug, so no
need to worry, but we should still fix it.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size")
Cc: Tony Luck <tony.luck@intel.com>
Cc: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/dmi_scan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c index f2483548cde9..0dc0c78f1fdb 100644 --- a/drivers/firmware/dmi_scan.c +++ b/drivers/firmware/dmi_scan.c @@ -407,7 +407,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v) bytes = ~0ull; else if (size & 0x8000) bytes = (u64)(size & 0x7fff) << 10; - else if (size != 0x7fff) + else if (size != 0x7fff || dm->length < 0x20) bytes = (u64)size << 20; else bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20; |