[PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

[PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

[jeandelu]

From: jean delu <jeandelu@tutamail.com>
Date: Sat, 8 Aug 2026 16:00:00 +0200
Subject: [PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

eisa_enumerator() trusts the contents of the EISA EEPROM.  The number
of slots is read from the EEPROM header and used to access the slot
records at HPEE_SLOT_INFO(i) = 20 + 48*i within the fixed-size
eeprom_buf (HPEE_MAX_LENGTH, 8192 bytes) without any bound check.  As
struct eeprom_eisa_slot_info is 48 bytes, only 170 records fit into the
buffer, but num_slots is a u8 and may be up to 255, so a corrupted
EEPROM makes the code read up to about 4 kB past the end of the buffer
(e.g. record 254 is accessed at offset 20 + 48*254 = 12212).

parse_slot_config() has the same kind of problem: it clamps
config_data_length against HPEE_MAX_LENGTH but does not take
config_data_offset into account, so the parser can walk past the end of
the buffer even when the offset itself is valid.

Clamp the number of slots so that all slot records fit into the buffer,
and hand the number of bytes actually available to parse_slot_config()
and bound the parse by it.

Signed-off-by: jean delu <jeandelu@tutamail.com>
---
drivers/parisc/eisa_enumerator.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/parisc/eisa_enumerator.c b/drivers/parisc/eisa_enumerator.c
index e0a57086a..f6014258e 100644
--- a/drivers/parisc/eisa_enumerator.c
+++ b/drivers/parisc/eisa_enumerator.c
@@ -311,6 +311,7 @@ static int configure_function(const unsigned char *buf, int *more)
 
static int parse_slot_config(int slot,
    const unsigned char *buf,
+			    unsigned int buflen,
    struct eeprom_eisa_slot_info *es, 
    struct resource *io_parent,
    struct resource *mem_parent)
@@ -333,8 +334,8 @@ static int parse_slot_config(int slot,
printk(KERN_INFO "EISA slot %d: %s %s ", 
      slot, board, es->flags&HPEE_FLAG_BOARD_IS_ISA ? "ISA" : "EISA");

-	maxlen = es->config_data_length < HPEE_MAX_LENGTH ?
-			es->config_data_length : HPEE_MAX_LENGTH;
+	/* never parse beyond the data that is actually in the buffer */
+	maxlen = min_t(unsigned int, es->config_data_length, buflen);
while ((pos < maxlen) && (num_func <= es->num_functions)) {
pos+=configure_function(buf+pos, &function_len); 

@@ -491,6 +492,13 @@ int eisa_enumerator(unsigned long eeprom_addr,
printk(KERN_INFO "Enumerating EISA bus\n");
  
eh = (struct eeprom_header*)(eeprom_buf);
+	/*
+	* The EEPROM contents are not to be trusted: clamp the number of
+	* slots so that all slot records fit into eeprom_buf.
+	*/
+	eh->num_slots = min_t(u8, eh->num_slots,
+			     (HPEE_MAX_LENGTH - sizeof(*eh)) /
+			     sizeof(struct eeprom_eisa_slot_info));
for (i=0;i<eh->num_slots;i++) {
struct eeprom_eisa_slot_info *es;

@@ -503,6 +511,7 @@ int eisa_enumerator(unsigned long eeprom_addr,

if (es->config_data_offset < HPEE_MAX_LENGTH) {
if (parse_slot_config(i+1, &eeprom_buf[es->config_data_offset],
+					     HPEE_MAX_LENGTH - es->config_data_offset,
     es, io_parent, mem_parent)) {
return -1;
}
-- 
2.43.0

Re: [PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

[Helge Deller]

On 8/8/26 16:02, jeandelu@tutamail.com wrote:
> From: jean delu <jeandelu@tutamail.com>
> Date: Sat, 8 Aug 2026 16:00:00 +0200
> Subject: [PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer
> 
> eisa_enumerator() trusts the contents of the EISA EEPROM.  The number
> of slots is read from the EEPROM header and used to access the slot
> records at HPEE_SLOT_INFO(i) = 20 + 48*i within the fixed-size
> eeprom_buf (HPEE_MAX_LENGTH, 8192 bytes) without any bound check.  As
> struct eeprom_eisa_slot_info is 48 bytes, only 170 records fit into the
> buffer, but num_slots is a u8 and may be up to 255, so a corrupted
> EEPROM makes the code read up to about 4 kB past the end of the buffer
> (e.g. record 254 is accessed at offset 20 + 48*254 = 12212).
> 
> parse_slot_config() has the same kind of problem: it clamps
> config_data_length against HPEE_MAX_LENGTH but does not take
> config_data_offset into account, so the parser can walk past the end of
> the buffer even when the offset itself is valid.
> 
> Clamp the number of slots so that all slot records fit into the buffer,
> and hand the number of bytes actually available to parse_slot_config()
> and bound the parse by it.
> 
> Signed-off-by: jean delu <jeandelu@tutamail.com>
> ---
> drivers/parisc/eisa_enumerator.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/parisc/eisa_enumerator.c b/drivers/parisc/eisa_enumerator.c
> index e0a57086a..f6014258e 100644
> --- a/drivers/parisc/eisa_enumerator.c
> +++ b/drivers/parisc/eisa_enumerator.c
> @@ -311,6 +311,7 @@ static int configure_function(const unsigned char *buf, int *more)
>   
> static int parse_slot_config(int slot,
>      const unsigned char *buf,
> +			    unsigned int buflen,

Can you please resend this patch?
Your indenting is compeletely wrong.
It might be your mail program, your mail provider or your editor who
messes up the whitespaces.

Helge