Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a814c359 authored by Jean Delvare's avatar Jean Delvare
Browse files

firmware: dmi_scan: Check DMI structure length 



Before accessing DMI data to record it for later, we should ensure
that the DMI structures are large enough to contain the data in
question.

Signed-off-by: default avatarJean Delvare <jdelvare@suse.de>
Reviewed-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
parent e0733e97

drivers/firmware/dmi_scan.c

+16 −7
Original line number Original line Diff line number Diff line
@@ -178,7 +178,7 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot, 
	const char *d = (const char *) dm;

	const char *d = (const char *) dm;

	const char *p;

	const char *p;





	if (dmi_ident[slot])

	if (dmi_ident[slot] || dm->length <= string)

		return;

		return;





	p = dmi_string(dm, d[string]);

	p = dmi_string(dm, d[string]);
@@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot, 
static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,

static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,

		int index)

		int index)

{

{

	const u8 *d = (u8 *) dm + index;

	const u8 *d;

	char *s;

	char *s;

	int is_ff = 1, is_00 = 1, i;

	int is_ff = 1, is_00 = 1, i;





	if (dmi_ident[slot])

	if (dmi_ident[slot] || dm->length <= index + 16)

		return;

		return;





	d = (u8 *) dm + index;

	for (i = 0; i < 16 && (is_ff || is_00); i++) {

	for (i = 0; i < 16 && (is_ff || is_00); i++) {

		if (d[i] != 0x00)

		if (d[i] != 0x00)

			is_00 = 0;

			is_00 = 0;
@@ -228,16 +229,17 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, 
static void __init dmi_save_type(const struct dmi_header *dm, int slot,

static void __init dmi_save_type(const struct dmi_header *dm, int slot,

		int index)

		int index)

{

{

	const u8 *d = (u8 *) dm + index;

	const u8 *d;

	char *s;

	char *s;





	if (dmi_ident[slot])

	if (dmi_ident[slot] || dm->length <= index)

		return;

		return;





	s = dmi_alloc(4);

	s = dmi_alloc(4);

	if (!s)

	if (!s)

		return;

		return;





	d = (u8 *) dm + index;

	sprintf(s, "%u", *d & 0x7F);

	sprintf(s, "%u", *d & 0x7F);

	dmi_ident[slot] = s;

	dmi_ident[slot] = s;

}

}
@@ -278,9 +280,13 @@ static void __init dmi_save_devices(const struct dmi_header *dm) 




static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)

static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)

{

{

	int i, count = *(u8 *)(dm + 1);

	int i, count;

	struct dmi_device *dev;

	struct dmi_device *dev;





	if (dm->length < 0x05)

		return;



	count = *(u8 *)(dm + 1);

	for (i = 1; i <= count; i++) {

	for (i = 1; i <= count; i++) {

		const char *devname = dmi_string(dm, i);

		const char *devname = dmi_string(dm, i);
@@ -353,6 +359,9 @@ static void __init dmi_save_extended_devices(const struct dmi_header *dm) 
	const char *name;

	const char *name;

	const u8 *d = (u8 *)dm;

	const u8 *d = (u8 *)dm;





	if (dm->length < 0x0B)

		return;



	/* Skip disabled device */

	/* Skip disabled device */

	if ((d[0x5] & 0x80) == 0)

	if ((d[0x5] & 0x80) == 0)

		return;

		return;
@@ -387,7 +396,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v) 
	const char *d = (const char *)dm;

	const char *d = (const char *)dm;

	static int nr;

	static int nr;





	if (dm->type != DMI_ENTRY_MEM_DEVICE)

	if (dm->type != DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)

		return;

		return;

	if (nr >= dmi_memdev_nr) {

	if (nr >= dmi_memdev_nr) {

		pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");

		pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");