lkml.org 
[lkml]   [2002]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch] fix two panics in microcode driver
Hi Marcelo,

When writing too little (0) or too much (>num_physpages) of microcode data
to the driver it will panic because of passing illegal size request to
vmalloc() (which has an explicit BUG() on these).

Fix is attached.

Regards,
Tigran


--- arch/i386/kernel/microcode.c.0 Fri Mar 22 18:22:12 2002
+++ arch/i386/kernel/microcode.c Fri Mar 22 18:27:03 2002
@@ -55,6 +55,8 @@
* Tigran Aivazian <tigran@veritas.com>,
* Serialize updates as required on HT processors due to speculative
* nature of implementation.
+ * 1.11 22 Mar 2001 Tigran Aivazian <tigran@veritas.com>
+ * Fix the panic when writing zero-length microcode chunk.
*/

#include <linux/init.h>
@@ -73,7 +75,7 @@

static spinlock_t microcode_update_lock = SPIN_LOCK_UNLOCKED;

-#define MICROCODE_VERSION "1.10"
+#define MICROCODE_VERSION "1.11"

MODULE_DESCRIPTION("Intel CPU (IA-32) microcode update driver");
MODULE_AUTHOR("Tigran Aivazian <tigran@veritas.com>");
@@ -330,9 +332,13 @@
{
ssize_t ret;

- if (len % sizeof(struct microcode) != 0) {
+ if (!len || len % sizeof(struct microcode) != 0) {
printk(KERN_ERR "microcode: can only write in N*%d bytes units\n",
sizeof(struct microcode));
+ return -EINVAL;
+ }
+ if ((len >> PAGE_SHIFT) > num_physpages) {
+ printk(KERN_ERR "microcode: too much data (max %d pages)\n", num_physpages);
return -EINVAL;
}
down_write(&microcode_rwsem);
\
 
 \ /
  Last update: 2005-03-22 13:25    [from the cache]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog