From: Jean Delvare <jdelvare@suse.de>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>,
Sasha Levin <Alexander.Levin@microsoft.com>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Andy Shevchenko <andy.shevchenko@gmail.com>,
Linus Walleij <linus.walleij@linaro.org>
Subject: [PATCH] firmware: dmi_scan: Fix UUID length safety check
Date: Mon, 9 Apr 2018 14:51:43 +0200 [thread overview]
Message-ID: <20180409145143.4daa1706@endymion> (raw)
The test which ensures that the DMI type 1 structure is long enough
to hold the UUID is off by one. It would fail if the structure is
exactly 24 bytes long, while that's sufficient to hold the UUID.
I don't expect this bug to cause problem in practice because all
implementations I have seen had length 8, 25 or 27 bytes, in line
with the SMBIOS specifications. But let's fix it still.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: a814c3597a6b ("firmware: dmi_scan: Check DMI structure length")
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
---
drivers/firmware/dmi_scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-4.16.orig/drivers/firmware/dmi_scan.c 2018-04-08 09:32:20.508719012 +0200
+++ linux-4.16/drivers/firmware/dmi_scan.c 2018-04-09 11:24:57.937044642 +0200
@@ -186,7 +186,7 @@ static void __init dmi_save_uuid(const s
char *s;
int is_ff = 1, is_00 = 1, i;
- if (dmi_ident[slot] || dm->length <= index + 16)
+ if (dmi_ident[slot] || dm->length < index + 16)
return;
d = (u8 *) dm + index;
--
Jean Delvare
SUSE L3 Support
next reply other threads:[~2018-04-09 12:51 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-09 12:51 Jean Delvare [this message]
2018-04-10 7:19 ` [PATCH] firmware: dmi_scan: Fix UUID length safety check Mika Westerberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180409145143.4daa1706@endymion \
--to=jdelvare@suse.de \
--cc=Alexander.Levin@microsoft.com \
--cc=andy.shevchenko@gmail.com \
--cc=dmitry.torokhov@gmail.com \
--cc=linus.walleij@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mika.westerberg@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox