On Mon, 9 Apr 2018 00:23:55 +0000, Sasha Levin wrote:
From: Jean Delvare jdelvare@suse.de
[ Upstream commit a814c3597a6b6040e2ef9459748081a6d5b7312d ]
Before accessing DMI data to record it for later, we should ensure that the DMI structures are large enough to contain the data in question.
Signed-off-by: Jean Delvare jdelvare@suse.de Reviewed-by: Mika Westerberg mika.westerberg@linux.intel.com Cc: Dmitry Torokhov dmitry.torokhov@gmail.com Cc: Andy Shevchenko andy.shevchenko@gmail.com Cc: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin alexander.levin@microsoft.com
drivers/firmware/dmi_scan.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) (...) @@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot, static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int index) {
- const u8 *d = (u8 *) dm + index;
- const u8 *d; char *s; int is_ff = 1, is_00 = 1, i;
- if (dmi_ident[slot])
- if (dmi_ident[slot] || dm->length <= index + 16)
I'm afraid this check is off by one and nobody noticed :-( I'll send a fix-up patch.
Probably harmless in practice as I have never seen a system with a DMI type 1 structure of exactly 24 bytes (would be 8 bytes for very old implementations and at least 25 for anything even remotely recent), but still not good. Sorry about that.
return;
- d = (u8 *) dm + index; for (i = 0; i < 16 && (is_ff || is_00); i++) { if (d[i] != 0x00) is_00 = 0;