AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

* Fix integer overflow issue in the DMI SMBIOS 3.0 code when

Browse Source 
calculating the number of DMI table entries - Jean Delvare
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVFVAYAAoJEC84WcCNIz1VPNYQAISdgO3dgFFo4k0SQQ6Bjpqa
 wQ6Y+nfsOQi6FyMYPO/Fjag8H++QQqvxI7V2p++Aj7kitICyNhzpdWlgP7+SScbJ
 XR6JUWG8UHlkL0pGjYEqIQ+X9D2xILCfO4gEFJ22gfQJwks3lXOfvBaah8Hfoj1Z
 WHjUR2E5MbmDcCC4/amyOV8EF1dnj30lYerW0Qhv9q/o4eq3h+znBb2muap7Ctng
 HvSWaK4ZGtdz+xMvDtqTzTBSSyA/6kaWH7fRhySGG1pSvZHVDvfIfAO9XVs4oKnX
 vIvhiCHATB2+PZML38U+/nvJZTicDgF6XeJyoMZeE3KEZ/UoYYzhv/DPI0rPIonk
 Za2kaiC9BfNsIMgEfh9jVpRrek/4t73FYAwpwnbNxzzklXWVeJcC8PcfPkuqHHin
 BMsBEH0vz/eI7aQ4HY7iail0TB278Z0FexRFUDKeQsNdXW5wcO1seNbkNPvTW01k
 xqHb4JMm2hyDUXRFqrncUr6362zV7s3eiIRnpoMcNK3ZD4gKkuCUHAoma+NimeLu
 3UMs+O/Qv1lzpg8JWScyKdwpVK4OrEeX20O/SeIR7XyGYw2fdksDKMB0l0y+hIdD
 +IDuH55ThaxqYGRhYtIQXck9LqR3rdrDZDQzwVr0iNS6U8zN5Zzs9ybXfKoZmjgk
 zI4ooTN/aNvkS98fD8y8
 =oUNN
 -----END PGP SIGNATURE-----

Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/urgent

Pull EFI fix from Matt Fleming:

  - Fix integer overflow issue in the DMI SMBIOS 3.0 code when
    calculating the number of DMI table entries. (Jean Delvare)

Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Ingo Molnar 2015-03-31 10:45:47 +02:00
commit 36cbf25dc7
1 changed files with 7 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/firmware/dmi_scan.c
View File

@ -86,10 +86,13 @@ static void dmi_table(u8 *buf, u32 len, int num,
int i = 0;
/*
* Stop when we see all the items the table claimed to have
* OR we run off the end of the table (also happens)
* Stop when we have seen all the items the table claimed to have
* (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
* off the end of the table (should never happen but sometimes does
* on bogus implementations.)
*/
while ((i < num) && (data - buf + sizeof(struct dmi_header)) <= len) {
while ((!num || i < num) &&
(data - buf + sizeof(struct dmi_header)) <= len) {
const struct dmi_header *dm = (const struct dmi_header *)data;
/*
@ -529,21 +532,10 @@ static int __init dmi_smbios3_present(const u8 *buf)
if (memcmp(buf, "_SM3_", 5) == 0 &&
buf[6] < 32 && dmi_checksum(buf, buf[6])) {
dmi_ver = get_unaligned_be16(buf + 7);
dmi_num = 0; /* No longer specified */
dmi_len = get_unaligned_le32(buf + 12);
dmi_base = get_unaligned_le64(buf + 16);
/*
* The 64-bit SMBIOS 3.0 entry point no longer has a field
* containing the number of structures present in the table.
* Instead, it defines the table size as a maximum size, and
* relies on the end-of-table structure type (#127) to be used
* to signal the end of the table.
* So let's define dmi_num as an upper bound as well: each
* structure has a 4 byte header, so dmi_len / 4 is an upper
* bound for the number of structures in the table.
*/
dmi_num = dmi_len / 4;
if (dmi_walk_early(dmi_decode) == 0) {
pr_info("SMBIOS %d.%d present.\n",
dmi_ver >> 8, dmi_ver & 0xFF);