summaryrefslogtreecommitdiff
path: root/drivers/firmware/dmi_scan.c
diff options
context:
space:
mode:
authorJean Delvare <jdelvare@suse.de>2019-10-14 22:41:24 +0300
committerJean Delvare <jdelvare@suse.de>2019-10-14 22:41:24 +0300
commit81dde26de9c08bb04c4962a15608778aaffb3cf9 (patch)
treebc604f0869cd029884a34fca379c5a70da2ab1c8 /drivers/firmware/dmi_scan.c
parent4d856f72c10ecb060868ed10ff1b1453943fc6c8 (diff)
downloadlinux-81dde26de9c08bb04c4962a15608778aaffb3cf9.tar.xz
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
Before reading the Extended Size field, we should ensure it fits in the DMI record. There is already a record length check but it does not cover that field. It would take a seriously corrupted DMI table to hit that bug, so no need to worry, but we should still fix it. Signed-off-by: Jean Delvare <jdelvare@suse.de> Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size") Cc: Tony Luck <tony.luck@intel.com> Cc: Borislav Petkov <bp@suse.de>
Diffstat (limited to 'drivers/firmware/dmi_scan.c')
-rw-r--r--drivers/firmware/dmi_scan.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 35ed56b9c34f..1e21fc3e9851 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -408,7 +408,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
bytes = ~0ull;
else if (size & 0x8000)
bytes = (u64)(size & 0x7fff) << 10;
- else if (size != 0x7fff)
+ else if (size != 0x7fff || dm->length < 0x20)
bytes = (u64)size << 20;
else
bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;