korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 04:18:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

firmware: dmi: Stop decoding on broken entry

Browse Source 
[ Upstream commit 0ef11f6045 ]

If a DMI table entry is shorter than 4 bytes, it is invalid. Due to
how DMI table parsing works, it is impossible to safely recover from
such an error, so we have to stop decoding the table.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Link: https://lore.kernel.org/linux-kernel/Zh2K3-HLXOesT_vZ@liuwe-devbox-debian-v2/T/
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jean Delvare 2024-04-30 18:29:32 +02:00 committed by Greg Kroah-Hartman
parent 03f37e5630
commit c2a350a3fa
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/firmware/dmi_scan.c
View File

@ -95,6 +95,17 @@ static void dmi_decode_table(u8 *buf,
(data - buf + sizeof(struct dmi_header)) <= dmi_len) { (data - buf + sizeof(struct dmi_header)) <= dmi_len) {
const struct dmi_header *dm = (const struct dmi_header *)data; const struct dmi_header *dm = (const struct dmi_header *)data;
/*
* If a short entry is found (less than 4 bytes), not only it
* is invalid, but we cannot reliably locate the next entry.
*/
if (dm->length < sizeof(struct dmi_header)) {
pr_warn(FW_BUG
"Corrupted DMI table, offset %zd (only %d entries processed)\n",
data - buf, i);
break;
}
/* /*
* We want to know the total length (formatted area and * We want to know the total length (formatted area and
* strings) before decoding to make sure we won't run off the * strings) before decoding to make sure we won't run off the