]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
authorJean Delvare <jdelvare@suse.de>
Mon, 14 Oct 2019 19:41:24 +0000 (21:41 +0200)
committerKhalid Elmously <khalid.elmously@canonical.com>
Fri, 6 Mar 2020 07:25:26 +0000 (02:25 -0500)
commit81e4c7f23fba376b490af10c7a3977726219f800
tree91275bb71423554795235695efc42b9c4fbaea31
parenteff4715b9eb8653ab56c9e66b4dfd30eb5a72510
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices

BugLink: https://bugs.launchpad.net/bugs/1864060
[ Upstream commit 81dde26de9c08bb04c4962a15608778aaffb3cf9 ]

Before reading the Extended Size field, we should ensure it fits in
the DMI record. There is already a record length check but it does
not cover that field.

It would take a seriously corrupted DMI table to hit that bug, so no
need to worry, but we should still fix it.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size")
Cc: Tony Luck <tony.luck@intel.com>
Cc: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
drivers/firmware/dmi_scan.c