| Date | Mon, 9 Apr 2018 11:24:16 +0200 | From | Jean Delvare <> | Subject | Re: [PATCH AUTOSEL for 4.9 078/293] firmware: dmi_scan: Check DMI structure length |
| |
On Mon, 9 Apr 2018 00:23:55 +0000, Sasha Levin wrote: > From: Jean Delvare <jdelvare@suse.de> > > [ Upstream commit a814c3597a6b6040e2ef9459748081a6d5b7312d ] > > Before accessing DMI data to record it for later, we should ensure > that the DMI structures are large enough to contain the data in > question. > > Signed-off-by: Jean Delvare <jdelvare@suse.de> > Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> > Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> > Cc: Andy Shevchenko <andy.shevchenko@gmail.com> > Cc: Linus Walleij <linus.walleij@linaro.org> > Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> > --- > drivers/firmware/dmi_scan.c | 23 ++++++++++++++++------- > 1 file changed, 16 insertions(+), 7 deletions(-) > (...) > @@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot, > static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, > int index) > { > - const u8 *d = (u8 *) dm + index; > + const u8 *d; > char *s; > int is_ff = 1, is_00 = 1, i; > > - if (dmi_ident[slot]) > + if (dmi_ident[slot] || dm->length <= index + 16)
I'm afraid this check is off by one and nobody noticed :-( I'll send a fix-up patch.
Probably harmless in practice as I have never seen a system with a DMI type 1 structure of exactly 24 bytes (would be 8 bytes for very old implementations and at least 25 for anything even remotely recent), but still not good. Sorry about that.
> return; > > + d = (u8 *) dm + index; > for (i = 0; i < 16 && (is_ff || is_00); i++) { > if (d[i] != 0x00) > is_00 = 0;
-- Jean Delvare SUSE L3 Support
|