From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756516AbbCCNA7 (ORCPT ); Tue, 3 Mar 2015 08:00:59 -0500 Received: from terminus.zytor.com ([198.137.202.10]:52416 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751263AbbCCNA6 (ORCPT ); Tue, 3 Mar 2015 08:00:58 -0500 Date: Tue, 3 Mar 2015 05:00:33 -0800 From: tip-bot for Quentin Casasnovas Message-ID: Cc: quentin.casasnovas@oracle.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, mingo@kernel.org, hpa@zytor.com, bp@suse.de Reply-To: tglx@linutronix.de, mingo@kernel.org, bp@suse.de, hpa@zytor.com, quentin.casasnovas@oracle.com, linux-kernel@vger.kernel.org In-Reply-To: <20150225094125.GB30434@chrystal.uk.oracle.com> References: <20150225094125.GB30434@chrystal.uk.oracle.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/microcode] x86/microcode/intel: Fix out of bounds memory access to the extended header Git-Commit-ID: d496a002ae1f02425168e5211c237abee588651a X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: d496a002ae1f02425168e5211c237abee588651a Gitweb: http://git.kernel.org/tip/d496a002ae1f02425168e5211c237abee588651a Author: Quentin Casasnovas AuthorDate: Thu, 26 Feb 2015 18:03:59 +0100 Committer: Borislav Petkov CommitDate: Mon, 2 Mar 2015 20:30:42 +0100 x86/microcode/intel: Fix out of bounds memory access to the extended header Improper pointer arithmetics when calculating the address of the extended header could lead to an out of bounds memory read and kernel panic. Signed-off-by: Quentin Casasnovas Link: http://lkml.kernel.org/r/20150225094125.GB30434@chrystal.uk.oracle.com Signed-off-by: Borislav Petkov --- arch/x86/kernel/cpu/microcode/intel_early.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c index 420eb93..3a6c613 100644 --- a/arch/x86/kernel/cpu/microcode/intel_early.c +++ b/arch/x86/kernel/cpu/microcode/intel_early.c @@ -180,8 +180,7 @@ matching_model_microcode(struct microcode_header_intel *mc_header, if (total_size <= data_size + MC_HEADER_SIZE) return UCODE_NFOUND; - ext_header = (struct extended_sigtable *) - mc_header + data_size + MC_HEADER_SIZE; + ext_header = (void *) mc_header + data_size + MC_HEADER_SIZE; ext_sigcount = ext_header->count; ext_sig = (void *)ext_header + EXT_HEADER_SIZE; @@ -457,8 +456,7 @@ static void __ref show_saved_mc(void) if (total_size <= data_size + MC_HEADER_SIZE) continue; - ext_header = (struct extended_sigtable *) - mc_saved_header + data_size + MC_HEADER_SIZE; + ext_header = (void *) mc_saved_header + data_size + MC_HEADER_SIZE; ext_sigcount = ext_header->count; ext_sig = (void *)ext_header + EXT_HEADER_SIZE;