Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753491AbcCAMNQ (ORCPT ); Tue, 1 Mar 2016 07:13:16 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:33731 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752309AbcCAMNO (ORCPT ); Tue, 1 Mar 2016 07:13:14 -0500 From: Chris Bainbridge To: bp@alien8.de Cc: Chris Bainbridge , x86@kernel.org, linux-kernel@vger.kernel.org, hmh@hmh.eng.br Subject: [PATCH v2] x86/microcode: Change checksum to u32 Date: Tue, 1 Mar 2016 12:12:39 +0000 Message-Id: <1456834359-5132-1-git-send-email-chris.bainbridge@gmail.com> X-Mailer: git-send-email 2.1.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3246 Lines: 69 Checksum should be unsigned 32-bit otherwise the calculation overflow results in undefined behaviour: [ 0.000000] ================================================================================ [ 0.000000] UBSAN: Undefined behaviour in arch/x86/kernel/cpu/microcode/intel_lib.c:105:12 [ 0.000000] signed integer overflow: [ 0.000000] -1500151068 + -2125470173 cannot be represented in type 'int' [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.5.0-rc5+ #495 [ 0.000000] 0000000000000086 0000000000000086 0000000000000000 ffffffff83203968 [ 0.000000] ffffffff81b30952 ffffffff834c43b8 ffffffff83203998 ffffffff814fe623 [ 0.000000] ffffffff83203980 ffffffff81bcdf2d ffffffff8339a448 ffffffff83203a08 [ 0.000000] Call Trace: [ 0.000000] [] dump_stack+0x4e/0x6c [ 0.000000] [] ? inotify_ioctl+0x43/0x1c0 [ 0.000000] [] ubsan_epilogue+0xd/0x40 [ 0.000000] [] handle_overflow+0xbd/0xe0 [ 0.000000] [] __ubsan_handle_add_overflow+0xe/0x10 [ 0.000000] [] microcode_sanity_check+0x405/0x590 [ 0.000000] [] get_matching_model_microcode.isra.2.constprop.8+0xa5/0x345 [ 0.000000] [] ? early_idt_handler_common+0x3d/0xae [ 0.000000] [] ? strlcpy+0x52/0xa0 [ 0.000000] [] ? find_cpio_data+0x371/0x510 [ 0.000000] [] load_ucode_intel_bsp+0xa1/0xe5 [ 0.000000] [] load_ucode_bsp+0xdf/0xf3 [ 0.000000] [] ? load_ucode_bsp+0xdf/0xf3 [ 0.000000] [] x86_64_start_kernel+0xd1/0xee [ 0.000000] ================================================================================ Link: https://lkml.org/lkml/2016/2/27/79 Signed-off-by: Chris Bainbridge --- arch/x86/kernel/cpu/microcode/intel_lib.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/cpu/microcode/intel_lib.c b/arch/x86/kernel/cpu/microcode/intel_lib.c index b96896bcbdaf..99ca2c935777 100644 --- a/arch/x86/kernel/cpu/microcode/intel_lib.c +++ b/arch/x86/kernel/cpu/microcode/intel_lib.c @@ -49,7 +49,7 @@ int microcode_sanity_check(void *mc, int print_err) unsigned long total_size, data_size, ext_table_size; struct microcode_header_intel *mc_header = mc; struct extended_sigtable *ext_header = NULL; - int sum, orig_sum, ext_sigcount = 0, i; + u32 sum, orig_sum, ext_sigcount = 0, i; struct extended_signature *ext_sig; total_size = get_totalsize(mc_header); @@ -85,8 +85,8 @@ int microcode_sanity_check(void *mc, int print_err) /* check extended table checksum */ if (ext_table_size) { - int ext_table_sum = 0; - int *ext_tablep = (int *)ext_header; + u32 ext_table_sum = 0; + u32 *ext_tablep = (u32 *)ext_header; i = ext_table_size / DWSIZE; while (i--) @@ -102,7 +102,7 @@ int microcode_sanity_check(void *mc, int print_err) orig_sum = 0; i = (MC_HEADER_SIZE + data_size) / DWSIZE; while (i--) - orig_sum += ((int *)mc)[i]; + orig_sum += ((u32 *)mc)[i]; if (orig_sum) { if (print_err) pr_err("aborting, bad checksum\n"); -- 2.1.4