Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36bf50d7 authored by Andreas Herrmann's avatar Andreas Herrmann Committed by H. Peter Anvin
Browse files

x86, microcode, AMD: Fix broken ucode patch size check 



This issue was recently observed on an AMD C-50 CPU where a patch of
maximum size was applied.

Commit be62adb4 ("x86, microcode, AMD: Simplify ucode verification")
added current_size in get_matching_microcode(). This is calculated as
size of the ucode patch + 8 (ie. size of the header). Later this is
compared against the maximum possible ucode patch size for a CPU family.
And of course this fails if the patch has already maximum size.

Cc: <stable@vger.kernel.org> [3.3+]
Signed-off-by: default avatarAndreas Herrmann <andreas.herrmann3@amd.com>
Signed-off-by: default avatarBorislav Petkov <borislav.petkov@amd.com>
Link: http://lkml.kernel.org/r/1344361461-10076-1-git-send-email-bp@amd64.org


Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
parent cb09cad4

arch/x86/kernel/microcode_amd.c

+4 −3
Original line number Diff line number Diff line
@@ -143,11 +143,12 @@ static int get_matching_microcode(int cpu, const u8 *ucode_ptr, 
				  unsigned int *current_size)

{

	struct microcode_header_amd *mc_hdr;

	unsigned int actual_size;

	unsigned int actual_size, patch_size;

	u16 equiv_cpu_id;



	/* size of the current patch we're staring at */

	*current_size = *(u32 *)(ucode_ptr + 4) + SECTION_HDR_SIZE;

	patch_size = *(u32 *)(ucode_ptr + 4);

	*current_size = patch_size + SECTION_HDR_SIZE;



	equiv_cpu_id = find_equiv_id();

	if (!equiv_cpu_id)
@@ -174,7 +175,7 @@ static int get_matching_microcode(int cpu, const u8 *ucode_ptr, 
	/*

	 * now that the header looks sane, verify its size

	 */

	actual_size = verify_ucode_size(cpu, *current_size, leftover_size);

	actual_size = verify_ucode_size(cpu, patch_size, leftover_size);

	if (!actual_size)

		return 0;