| From 43bf9459da5712dbe01abfb246d7f7f9b030cc74 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 30 Apr 2024 18:29:32 +0200 |
| Subject: firmware: dmi: Stop decoding on broken entry |
| |
| From: Jean Delvare <jdelvare@suse.de> |
| |
| [ Upstream commit 0ef11f604503b1862a21597436283f158114d77e ] |
| |
| If a DMI table entry is shorter than 4 bytes, it is invalid. Due to |
| how DMI table parsing works, it is impossible to safely recover from |
| such an error, so we have to stop decoding the table. |
| |
| Signed-off-by: Jean Delvare <jdelvare@suse.de> |
| Link: https://lore.kernel.org/linux-kernel/Zh2K3-HLXOesT_vZ@liuwe-devbox-debian-v2/T/ |
| Reviewed-by: Michael Kelley <mhklinux@outlook.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/firmware/dmi_scan.c | 11 +++++++++++ |
| 1 file changed, 11 insertions(+) |
| |
| diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c |
| index 1e21fc3e9851a..537c104652f71 100644 |
| --- a/drivers/firmware/dmi_scan.c |
| +++ b/drivers/firmware/dmi_scan.c |
| @@ -96,6 +96,17 @@ static void dmi_decode_table(u8 *buf, |
| (data - buf + sizeof(struct dmi_header)) <= dmi_len) { |
| const struct dmi_header *dm = (const struct dmi_header *)data; |
| |
| + /* |
| + * If a short entry is found (less than 4 bytes), not only it |
| + * is invalid, but we cannot reliably locate the next entry. |
| + */ |
| + if (dm->length < sizeof(struct dmi_header)) { |
| + pr_warn(FW_BUG |
| + "Corrupted DMI table, offset %zd (only %d entries processed)\n", |
| + data - buf, i); |
| + break; |
| + } |
| + |
| /* |
| * We want to know the total length (formatted area and |
| * strings) before decoding to make sure we won't run off the |
| -- |
| 2.43.0 |
| |
