Messages in this thread Patch in this message | | | From | "Maciej S. Szmigiero" <> | Subject | [PATCH v3 5/9] x86/microcode/AMD: check patch size in verify_and_add_patch() | Date | Tue, 13 Mar 2018 22:06:54 +0100 |
| |
Now that we have the PATCH_MAX_SIZE macro correctly computed we can verify properly the indicated size of a patch in a microcode container file and whether this file is actually large enough to contain it in the late loader verify_and_add_patch() function.
The early loader already does the PATCH_MAX_SIZE check in parse_container() function.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name> --- arch/x86/kernel/cpu/microcode/amd.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index b9f6c06bdc16..0f78200f2f6c 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -485,7 +485,7 @@ static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig) } static unsigned int verify_patch_size(u8 family, u32 patch_size, - unsigned int size) + size_t size) { u32 max_size; @@ -507,7 +507,7 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size, break; } - if (patch_size > min_t(u32, size, max_size)) { + if (patch_size > min_t(size_t, size, max_size)) { pr_err("patch size mismatch\n"); return 0; } @@ -616,7 +616,7 @@ static void cleanup(void) * driver cannot continue functioning normally. In such cases, we tear * down everything we've used up so far and exit. */ -static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover) +static int verify_and_add_patch(u8 family, u8 *fw, size_t leftover) { struct microcode_header_amd *mc_hdr; struct ucode_patch *patch; @@ -624,7 +624,15 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover) u32 proc_fam; u16 proc_id; + if (leftover < SECTION_HDR_SIZE + sizeof(*mc_hdr)) + return leftover; + patch_size = *(u32 *)(fw + 4); + if (patch_size > PATCH_MAX_SIZE) { + pr_err("patch size %u too large\n", patch_size); + return -EINVAL; + } + crnt_size = patch_size + SECTION_HDR_SIZE; mc_hdr = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE); proc_id = mc_hdr->processor_rev_id;
| |