lkml.org 
[lkml]   [2011]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[tip:x86/setup] x86, setup: Fix EDD3.0 data verification.
    Commit-ID:  0c61227094b3ddaca2f847ee287c4a2e3762b5a2
    Gitweb: http://git.kernel.org/tip/0c61227094b3ddaca2f847ee287c4a2e3762b5a2
    Author: Gleb Natapov <gleb@redhat.com>
    AuthorDate: Tue, 26 Apr 2011 11:21:32 +0300
    Committer: H. Peter Anvin <hpa@linux.intel.com>
    CommitDate: Wed, 27 Apr 2011 14:16:12 -0700

    x86, setup: Fix EDD3.0 data verification.

    Check for nonzero path in edd_has_edd30() has no sense. First, it looks
    at the wrong memory. Device path starts at offset 30 of the info->params
    structure which is at offset 8 from the beginning of info structure,
    but code looks at info + 4 instead. This was correct when code was
    introduced, but around v2.6.4 three more fields were added to edd_info
    structure (commit 66b61a5c in history.git). Second, even if it will check
    correct memory it will always succeed since at offset 30 (params->key)
    there will be non-zero values otherwise previous check would fail.

    The patch replaces this bogus check with one that verifies checksum.

    Signed-off-by: Gleb Natapov <gleb@redhat.com>
    Link: http://lkml.kernel.org/r/20110426082132.GG2265@redhat.com
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    ---
    drivers/firmware/edd.c | 22 +++++++++++-----------
    1 files changed, 11 insertions(+), 11 deletions(-)

    diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
    index 96c25d9..f1b7f65 100644
    --- a/drivers/firmware/edd.c
    +++ b/drivers/firmware/edd.c
    @@ -531,8 +531,8 @@ static int
    edd_has_edd30(struct edd_device *edev)
    {
    struct edd_info *info;
    - int i, nonzero_path = 0;
    - char c;
    + int i;
    + u8 csum = 0;

    if (!edev)
    return 0;
    @@ -544,16 +544,16 @@ edd_has_edd30(struct edd_device *edev)
    return 0;
    }

    - for (i = 30; i <= 73; i++) {
    - c = *(((uint8_t *) info) + i + 4);
    - if (c) {
    - nonzero_path++;
    - break;
    - }
    - }
    - if (!nonzero_path) {
    +
    + /* We support only T13 spec */
    + if (info->params.device_path_info_length != 44)
    + return 0;
    +
    + for (i = 30; i < info->params.device_path_info_length + 30; i++)
    + csum += *(((u8 *)&info->params) + i);
    +
    + if (csum)
    return 0;
    - }

    return 1;
    }

    \
     
     \ /
      Last update: 2011-04-28 00:39    [W:0.044 / U:61.736 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site