]> git.baikalelectronics.ru Git - kernel.git/commit
firmware: dmi_scan: Prevent dmi_num integer overflow
authorJean Delvare <jdelvare@suse.de>
Fri, 20 Mar 2015 08:59:47 +0000 (09:59 +0100)
committerMatt Fleming <matt.fleming@intel.com>
Fri, 27 Mar 2015 10:53:46 +0000 (10:53 +0000)
commit25139cc29e7a70f5d3eafc6bc27e72c3153244ea
treed876c1735a8ea9718a3c6f5e122d5aee91547812
parent61ab19a532fa8a2b6e4789b1cab13595120f99e7
firmware: dmi_scan: Prevent dmi_num integer overflow

dmi_num is a u16, dmi_len is a u32, so this construct:

dmi_num = dmi_len / 4;

would result in an integer overflow for a DMI table larger than
256 kB. I've never see such a large table so far, but SMBIOS 3.0
makes it possible so maybe we'll see such tables in the future.

So instead of faking a structure count when the entry point does
not provide it, adjust the loop condition in dmi_table() to properly
deal with the case where dmi_num is not set.

This bug was introduced with the initial SMBIOS 3.0 support in commit
f93aca97116c ("dmi: add support for SMBIOS 3.0 64-bit entry point").

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Matt Fleming <matt.fleming@intel.com>
Cc: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Cc: <stable@vger.kernel.org>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
drivers/firmware/dmi_scan.c