lkml.org 
[lkml]   [2018]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.9 078/293] firmware: dmi_scan: Check DMI structure length
    Date
    From: Jean Delvare <jdelvare@suse.de>

    [ Upstream commit a814c3597a6b6040e2ef9459748081a6d5b7312d ]

    Before accessing DMI data to record it for later, we should ensure
    that the DMI structures are large enough to contain the data in
    question.

    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
    Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
    Cc: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    drivers/firmware/dmi_scan.c | 23 ++++++++++++++++-------
    1 file changed, 16 insertions(+), 7 deletions(-)

    diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
    index 8590f94de9dc..18afa448bb9a 100644
    --- a/drivers/firmware/dmi_scan.c
    +++ b/drivers/firmware/dmi_scan.c
    @@ -178,7 +178,7 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
    const char *d = (const char *) dm;
    const char *p;

    - if (dmi_ident[slot])
    + if (dmi_ident[slot] || dm->length <= string)
    return;

    p = dmi_string(dm, d[string]);
    @@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
    static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
    int index)
    {
    - const u8 *d = (u8 *) dm + index;
    + const u8 *d;
    char *s;
    int is_ff = 1, is_00 = 1, i;

    - if (dmi_ident[slot])
    + if (dmi_ident[slot] || dm->length <= index + 16)
    return;

    + d = (u8 *) dm + index;
    for (i = 0; i < 16 && (is_ff || is_00); i++) {
    if (d[i] != 0x00)
    is_00 = 0;
    @@ -228,16 +229,17 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
    static void __init dmi_save_type(const struct dmi_header *dm, int slot,
    int index)
    {
    - const u8 *d = (u8 *) dm + index;
    + const u8 *d;
    char *s;

    - if (dmi_ident[slot])
    + if (dmi_ident[slot] || dm->length <= index)
    return;

    s = dmi_alloc(4);
    if (!s)
    return;

    + d = (u8 *) dm + index;
    sprintf(s, "%u", *d & 0x7F);
    dmi_ident[slot] = s;
    }
    @@ -278,9 +280,13 @@ static void __init dmi_save_devices(const struct dmi_header *dm)

    static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)
    {
    - int i, count = *(u8 *)(dm + 1);
    + int i, count;
    struct dmi_device *dev;

    + if (dm->length < 0x05)
    + return;
    +
    + count = *(u8 *)(dm + 1);
    for (i = 1; i <= count; i++) {
    const char *devname = dmi_string(dm, i);

    @@ -353,6 +359,9 @@ static void __init dmi_save_extended_devices(const struct dmi_header *dm)
    const char *name;
    const u8 *d = (u8 *)dm;

    + if (dm->length < 0x0B)
    + return;
    +
    /* Skip disabled device */
    if ((d[0x5] & 0x80) == 0)
    return;
    @@ -387,7 +396,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
    const char *d = (const char *)dm;
    static int nr;

    - if (dm->type != DMI_ENTRY_MEM_DEVICE)
    + if (dm->type != DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)
    return;
    if (nr >= dmi_memdev_nr) {
    pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");
    --
    2.15.1
    \
     
     \ /
      Last update: 2018-04-09 04:30    [W:4.036 / U:0.564 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site