Received-SPF: pass (google.com: domain of linux-kernel+bounces-150218-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Michael Kelley <mhklinux@outlook.com>
To: Jean Delvare <jdelvare@suse.de>, Michael Schierl <schierlm@gmx.de>
CC: "linux-hyperv@vger.kernel.org" <linux-hyperv@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH v2] firmware: dmi: Stop decoding on broken entry
Thread-Topic: [PATCH v2] firmware: dmi: Stop decoding on broken entry
Thread-Index: AQHakYvPrt/ylfUZoUy5VQ48m3QhGLFuDMKA
Date: Thu, 18 Apr 2024 13:56:51 +0000
Message-ID:
 <SN6PR02MB41578A69B87041B9EEFF983BD40E2@SN6PR02MB4157.namprd02.prod.outlook.com>
References: <20240418142734.56e1db4b@endymion.delvare>
In-Reply-To: <20240418142734.56e1db4b@endymion.delvare>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?Gx0PIyryYMVcAmYLnWWIss4jnqJU/emBfDjbJUWeQ9dHHJ7wXhkufCAa9BCb?=
 =?us-ascii?Q?LKARJmHzkQgvGHMAnwICRcmv3hHeWkP6KBDfFFpA2LxAJyWL0b2EQClTd7ds?=
 =?us-ascii?Q?vClm15Qr16zhL+NMzNrY6i7QvPlvcBJoWIsOI3EQtO8vmfGfa09nF4j1d0Q7?=
 =?us-ascii?Q?3K4plgoWWFH6h3Yr0dvi9pEmXcIYPdJfIZWU3bDIFC6NZ2k0+MWWE46K6dBA?=
 =?us-ascii?Q?8tqxtR25hAKVD13h0gMpVVV4q8oxHHCWFFSUpMdPVpLuQTn6Gr88isbmpexk?=
 =?us-ascii?Q?HkXBvQjwYHMmlAdTJxxa5mQ9ojhPORGuQrN2JlopByCymf5R6OwfTku3P5NY?=
 =?us-ascii?Q?VKECW4fNpuiQoPBAdLbBznMAaVop/3mX1CczoGW12rY4Xf0Mkh64vVg0IvQb?=
 =?us-ascii?Q?406Vc2s4PTUmkm+oysHwYjHhMsFD+tdJYRgbwQN7bQiUvKMVXW8Dw3c7g2og?=
 =?us-ascii?Q?4FolEmi56xk74T1EWqg1nhNrP4EqbCR8wenS8D0s3WZuTdpv3tx6LrZJ45wy?=
 =?us-ascii?Q?QE+yvtF+ilmTc8PDVFY5MLWXLJqkylwxROvnaUrVldIrunQY5J8064fSl403?=
 =?us-ascii?Q?BF0dqOjKOaHpBKPM/MMrqGvz5aV4JHEAanENDNrPHTig5Ys69nMuw1UyaoMg?=
 =?us-ascii?Q?XhWGh3CjzvYad2hnRbMPq1yeAddjz1BI/3e6Hu6jPbNOAjIXliq6MmQQlwdI?=
 =?us-ascii?Q?cXiY5iPNQSaBtMi18tHbtxgRs4Vum344TP2Nld7pRMfIaBAa4QthtF9uAnWd?=
 =?us-ascii?Q?Rt/s9VdPqdnnjL6Na0HOb3jb2dndOfWrCG4U4suXke8QArUwHzFLOA2NLk+x?=
 =?us-ascii?Q?y2dhUJ44TxyGwdOH7qSVzK0xLvMdiPOkdiGmjAnOKstNw8ucLGcbmkxpy5Ss?=
 =?us-ascii?Q?EQ4Y7C5GMgvJdB+nwhDoZjFmmYm0c7jjkqDe5XwMQckE4dDfeIc3NpsBli84?=
 =?us-ascii?Q?7wGllP7FRxV0Qxm9V62oY98a3qk6zqyocKwtvEacPtTRWHkvF9rIVYMV8mkx?=
 =?us-ascii?Q?8omKqoe7ZX6Np1y4rmL7fGqV333BR2pQHZ+rmJd5ziugFG8h9+xImYOhfMKt?=
 =?us-ascii?Q?hqMIapEyVNBZlbNQHuepkybkIjhxt/g7P+x3T77U0967KkrTp1KoCju0hA5o?=
 =?us-ascii?Q?uEors6B7ZBV07owC2h57RcKBuWNmFI0hMYjGbKMVIt+xcq8+nzRShjvkXu/8?=
 =?us-ascii?Q?4X5LcYM3cuoxMnZME2NftGcIc9MId3WrIPrNdQ=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR02MB4157.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: d811348e-5fd9-46f2-d208-08dc5faf65e4
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Apr 2024 13:56:51.2963
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR0201MB8840

From: Jean Delvare <jdelvare@suse.de> Sent: Thursday, April 18, 2024 5:28 A=
M
>=20
> If a DMI table entry is shorter than 4 bytes, it is invalid. Due to
> how DMI table parsing works, it is impossible to safely recover from
> such an error, so we have to stop decoding the table.
>=20
> Signed-off-by: Jean Delvare <jdelvare@suse.de>
> Reported-by: Michael Schierl <schierlm@gmx.de>
> Link: https://lore.kernel.org/linux-kernel/Zh2K3-HLXOesT_vZ@liuwe-devbox-=
debian-v2/T/
> Tested-by: Michael Schierl <schierlm@gmx.de>
> ---
> Changes since v1:
>  * Also log the offset of the corrupted entry (suggested by Michael Kelle=
y)
>=20
>  drivers/firmware/dmi_scan.c |   11 +++++++++++
>  1 file changed, 11 insertions(+)
>=20
> --- linux-6.8.orig/drivers/firmware/dmi_scan.c
> +++ linux-6.8/drivers/firmware/dmi_scan.c
> @@ -102,6 +102,17 @@ static void dmi_decode_table(u8 *buf,
>  		const struct dmi_header *dm =3D (const struct dmi_header *)data;
>=20
>  		/*
> +		 * If a short entry is found (less than 4 bytes), not only it
> +		 * is invalid, but we cannot reliably locate the next entry.
> +		 */
> +		if (dm->length < sizeof(struct dmi_header)) {
> +			pr_warn(FW_BUG
> +				"Corrupted DMI table, offset %ld (only %d entries processed)\n",
> +				data - buf, i);
> +			break;
> +		}
> +
> +		/*
>  		 *  We want to know the total length (formatted area and
>  		 *  strings) before decoding to make sure we won't run off the
>  		 *  table in dmi_decode or dmi_string
>=20

Reviewed-by: Michael Kelley <mhklinux@outlook.com>