mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 00:20:32 +00:00
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
[ Upstream commit81dde26de9
] Before reading the Extended Size field, we should ensure it fits in the DMI record. There is already a record length check but it does not cover that field. It would take a seriously corrupted DMI table to hit that bug, so no need to worry, but we should still fix it. Signed-off-by: Jean Delvare <jdelvare@suse.de> Fixes:6deae96b42
("firmware, DMI: Add function to look up a handle and return DIMM size") Cc: Tony Luck <tony.luck@intel.com> Cc: Borislav Petkov <bp@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
fc7510d802
commit
b79d380017
1 changed files with 1 additions and 1 deletions
|
@ -407,7 +407,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
|
|||
bytes = ~0ull;
|
||||
else if (size & 0x8000)
|
||||
bytes = (u64)(size & 0x7fff) << 10;
|
||||
else if (size != 0x7fff)
|
||||
else if (size != 0x7fff || dm->length < 0x20)
|
||||
bytes = (u64)size << 20;
|
||||
else
|
||||
bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;
|
||||
|
|
Loading…
Reference in a new issue