leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

firmware: dmi: Fortify entry point length checks

Browse Source 
Ensure that the SMBIOS entry point is long enough to include all the
fields we need. Otherwise it is pointless to even attempt to verify
its checksum.

Also fix the maximum length check, which is technically 32, not 31.
It does not matter in practice as the only valid values are 31 (for
SMBIOS 2.x) and 24 (for SMBIOS 3.x), but let's still have the check
right in case new fields are added to either structure in the future.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/lkml/20220823094857.27f3d924@endymion.delvare/T/
This commit is contained in:
Jean Delvare 2022-09-23 14:53:14 +02:00
parent 521a547ced
commit 13a0ac816d
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/firmware/dmi_scan.c
View File

@ -567,8 +567,13 @@ static int __init dmi_present(const u8 *buf)
{
u32 smbios_ver;
/*
* The size of this structure is 31 bytes, but we also accept value
* 30 due to a mistake in SMBIOS specification version 2.1.
*/
if (memcmp(buf, "_SM_", 4) == 0 &&
buf[5] < 32 && dmi_checksum(buf, buf[5])) {
buf[5] >= 30 && buf[5] <= 32 &&
dmi_checksum(buf, buf[5])) {
smbios_ver = get_unaligned_be16(buf + 6);
smbios_entry_point_size = buf[5];
memcpy(smbios_entry_point, buf, smbios_entry_point_size);
@ -629,7 +634,8 @@ static int __init dmi_present(const u8 *buf)
static int __init dmi_smbios3_present(const u8 *buf)
{
if (memcmp(buf, "_SM3_", 5) == 0 &&
buf[6] < 32 && dmi_checksum(buf, buf[6])) {
buf[6] >= 24 && buf[6] <= 32 &&
dmi_checksum(buf, buf[6])) {
dmi_ver = get_unaligned_be24(buf + 7);
dmi_num = 0; /* No longer specified */
dmi_len = get_unaligned_le32(buf + 12);