Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Sasha Levin <Alexander.Levin@microsoft.com>
To:     "stable@vger.kernel.org" <stable@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
CC:     Jean Delvare <jdelvare@suse.de>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>,
        Andy Shevchenko <andy.shevchenko@gmail.com>,
        Linus Walleij <linus.walleij@linaro.org>,
        Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 4.9 078/293] firmware: dmi_scan: Check DMI
 structure length
Thread-Topic: [PATCH AUTOSEL for 4.9 078/293] firmware: dmi_scan: Check DMI
 structure length
Thread-Index: AQHTz5kLKBFqgwQbZkqWKm6/DRFLDw==
Date:   Mon, 9 Apr 2018 00:23:55 +0000
Message-ID: <20180409002239.163177-78-alexander.levin@microsoft.com>
References: <20180409002239.163177-1-alexander.levin@microsoft.com>
In-Reply-To: <20180409002239.163177-1-alexander.levin@microsoft.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: microsoft.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: bc6f70f8-c390-4725-9ddb-08d59db0d192
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Apr 2018 00:23:55.1905
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0807
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Jean Delvare <jdelvare@suse.de>

[ Upstream commit a814c3597a6b6040e2ef9459748081a6d5b7312d ]

Before accessing DMI data to record it for later, we should ensure
that the DMI structures are large enough to contain the data in
question.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 drivers/firmware/dmi_scan.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 8590f94de9dc..18afa448bb9a 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -178,7 +178,7 @@ static void __init dmi_save_ident(const struct dmi_head=
er *dm, int slot,
 	const char *d =3D (const char *) dm;
 	const char *p;
=20
-	if (dmi_ident[slot])
+	if (dmi_ident[slot] || dm->length <=3D string)
 		return;
=20
 	p =3D dmi_string(dm, d[string]);
@@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_he=
ader *dm, int slot,
 static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
 		int index)
 {
-	const u8 *d =3D (u8 *) dm + index;
+	const u8 *d;
 	char *s;
 	int is_ff =3D 1, is_00 =3D 1, i;
=20
-	if (dmi_ident[slot])
+	if (dmi_ident[slot] || dm->length <=3D index + 16)
 		return;
=20
+	d =3D (u8 *) dm + index;
 	for (i =3D 0; i < 16 && (is_ff || is_00); i++) {
 		if (d[i] !=3D 0x00)
 			is_00 =3D 0;
@@ -228,16 +229,17 @@ static void __init dmi_save_uuid(const struct dmi_hea=
der *dm, int slot,
 static void __init dmi_save_type(const struct dmi_header *dm, int slot,
 		int index)
 {
-	const u8 *d =3D (u8 *) dm + index;
+	const u8 *d;
 	char *s;
=20
-	if (dmi_ident[slot])
+	if (dmi_ident[slot] || dm->length <=3D index)
 		return;
=20
 	s =3D dmi_alloc(4);
 	if (!s)
 		return;
=20
+	d =3D (u8 *) dm + index;
 	sprintf(s, "%u", *d & 0x7F);
 	dmi_ident[slot] =3D s;
 }
@@ -278,9 +280,13 @@ static void __init dmi_save_devices(const struct dmi_h=
eader *dm)
=20
 static void __init dmi_save_oem_strings_devices(const struct dmi_header *d=
m)
 {
-	int i, count =3D *(u8 *)(dm + 1);
+	int i, count;
 	struct dmi_device *dev;
=20
+	if (dm->length < 0x05)
+		return;
+
+	count =3D *(u8 *)(dm + 1);
 	for (i =3D 1; i <=3D count; i++) {
 		const char *devname =3D dmi_string(dm, i);
=20
@@ -353,6 +359,9 @@ static void __init dmi_save_extended_devices(const stru=
ct dmi_header *dm)
 	const char *name;
 	const u8 *d =3D (u8 *)dm;
=20
+	if (dm->length < 0x0B)
+		return;
+
 	/* Skip disabled device */
 	if ((d[0x5] & 0x80) =3D=3D 0)
 		return;
@@ -387,7 +396,7 @@ static void __init save_mem_devices(const struct dmi_he=
ader *dm, void *v)
 	const char *d =3D (const char *)dm;
 	static int nr;
=20
-	if (dm->type !=3D DMI_ENTRY_MEM_DEVICE)
+	if (dm->type !=3D DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)
 		return;
 	if (nr >=3D dmi_memdev_nr) {
 		pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");
--=20
2.15.1