stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Ben Hutchings <ben@decadent.org.uk>,
	Tim McGrath <tmhikaru@gmail.com>,
	Zhenzhong Duan <zhenzhong.duan@oracle.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [ 36/40] dmi_scan: fix missing check for _DMI_ signature in smbios_present()
Date: Tue, 12 Mar 2013 15:43:57 -0700	[thread overview]
Message-ID: <20130312223215.344938494@linuxfoundation.org> (raw)
In-Reply-To: <20130312223211.492954675@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit a40e7cf8f06b4e322ba902e4e9f6a6b0c2daa907 upstream.

Commit 9f9c9cbb6057 ("drivers/firmware/dmi_scan.c: fetch dmi version
from SMBIOS if it exists") hoisted the check for "_DMI_" into
dmi_scan_machine(), which means that we don't bother to check for
"_DMI_" at offset 16 in an SMBIOS entry.  smbios_present() may also call
dmi_present() for an address where we found "_SM_", if it failed further
validation.

Check for "_DMI_" in smbios_present() before calling dmi_present().

[akpm@linux-foundation.org: fix build]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Reported-by: Tim McGrath <tmhikaru@gmail.com>
Tested-by: Tim Mcgrath <tmhikaru@gmail.com>
Cc: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/firmware/dmi_scan.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -442,7 +442,6 @@ static int __init dmi_present(const char
 static int __init smbios_present(const char __iomem *p)
 {
 	u8 buf[32];
-	int offset = 0;
 
 	memcpy_fromio(buf, p, 32);
 	if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
@@ -461,9 +460,9 @@ static int __init smbios_present(const c
 			dmi_ver = 0x0206;
 			break;
 		}
-		offset = 16;
+		return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
 	}
-	return dmi_present(buf + offset);
+	return 1;
 }
 
 void __init dmi_scan_machine(void)



  parent reply	other threads:[~2013-03-12 22:43 UTC|newest]

Thread overview: 52+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-03-12 22:43 [ 00/40] 3.4.36-stable review Greg Kroah-Hartman
2013-03-12 22:43 ` [ 01/40] ARM: VFP: fix emulation of second VFP instruction Greg Kroah-Hartman
2013-03-12 22:43 ` [ 02/40] ARM: fix scheduling while atomic warning in alignment handling code Greg Kroah-Hartman
2013-03-12 22:43 ` [ 03/40] xen/pci: We dont do multiple MSIs Greg Kroah-Hartman
2013-03-12 22:43 ` [ 04/40] SCSI: dc395x: uninitialized variable in device_alloc() Greg Kroah-Hartman
2013-03-12 22:43 ` [ 05/40] SCSI: storvsc: Initialize the sglist Greg Kroah-Hartman
2013-03-12 22:43 ` [ 06/40] target/pscsi: Fix page increment Greg Kroah-Hartman
2013-03-12 22:43 ` [ 07/40] btrfs: Init io_lock after cloning btrfs device struct Greg Kroah-Hartman
2013-03-12 22:43 ` [ 08/40] cifs: ensure that cifs_get_root() only traverses directories Greg Kroah-Hartman
2013-03-12 22:43 ` [ 09/40] NFS: Dont allow NFS silly-renamed files to be deleted, no signal Greg Kroah-Hartman
2013-03-12 22:43 ` [ 10/40] SUNRPC: Dont start the retransmission timer when out of socket space Greg Kroah-Hartman
2013-03-12 22:43 ` [ 11/40] ata_piix: reenable MS Virtual PC guests Greg Kroah-Hartman
2013-03-12 22:43 ` [ 12/40] hw_random: make buffer usable in scatterlist Greg Kroah-Hartman
2013-03-13 22:54   ` Satoru Takeuchi
2013-03-14  6:41     ` Rusty Russell
2013-03-14 13:24       ` [PATCH] hw_random: free rng_buffer at module exit Satoru Takeuchi
2013-03-15  5:05         ` Rusty Russell
2013-03-17  2:14           ` Ben Hutchings
2013-03-18  2:40             ` Rusty Russell
2013-03-20  0:29               ` Satoru Takeuchi
2013-03-12 22:43 ` [ 13/40] mwifiex: correct sleep delay counter Greg Kroah-Hartman
2013-03-12 22:43 ` [ 14/40] ath9k: fix RSSI dummy marker value Greg Kroah-Hartman
2013-03-12 22:43 ` [ 15/40] ath9k_hw: improve reset reliability after errors Greg Kroah-Hartman
2013-03-12 22:43 ` [ 16/40] md: protect against crash upon fsync on ro array Greg Kroah-Hartman
2013-03-12 22:43 ` [ 17/40] md: fix two bugs when attempting to resize RAID0 array Greg Kroah-Hartman
2013-03-12 22:43 ` [ 18/40] md: raid0: fix error return from create_stripe_zones Greg Kroah-Hartman
2013-03-12 22:43 ` [ 19/40] hwmon: (sht15) Check return value of regulator_enable() Greg Kroah-Hartman
2013-03-12 22:43 ` [ 20/40] hwmon: (pmbus/ltc2978) Fix peak attribute handling Greg Kroah-Hartman
2013-03-12 22:43 ` [ 21/40] hwmon: (pmbus/ltc2978) Use detected chip ID to select supported functionality Greg Kroah-Hartman
2013-03-12 22:43 ` [ 22/40] drm/radeon: add primary dac adj quirk for R200 board Greg Kroah-Hartman
2013-03-12 22:43 ` [ 23/40] ARM: 7663/1: perf: fix ARMv7 EVTYPE_MASK to include NSH bit Greg Kroah-Hartman
2013-03-12 22:43 ` [ 24/40] ALSA: ice1712: Initialize card->private_data properly Greg Kroah-Hartman
2013-03-12 22:43 ` [ 25/40] ALSA: vmaster: Fix slave change notification Greg Kroah-Hartman
2013-03-12 22:43 ` [ 26/40] e1000e: fix pci-device enable-counter balance Greg Kroah-Hartman
2013-03-12 22:43 ` [ 27/40] HID: logitech-dj: do not directly call hid_output_raw_report() during probe Greg Kroah-Hartman
2013-03-12 22:43 ` [ 28/40] xen/pat: Disable PAT using pat_enabled value Greg Kroah-Hartman
2013-03-12 22:43 ` [ 29/40] crypto: user - fix info leaks in report API Greg Kroah-Hartman
2013-03-12 22:43 ` [ 30/40] keys: fix race with concurrent install_user_keyrings() Greg Kroah-Hartman
2013-03-12 22:43 ` [ 31/40] Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys Greg Kroah-Hartman
2013-03-12 22:43 ` [ 32/40] vfs: fix pipe counter breakage Greg Kroah-Hartman
2013-03-12 22:43 ` [ 33/40] rtc: rtc-mv: Add support for clk to avoid lockups Greg Kroah-Hartman
2013-03-12 23:08   ` Jason Cooper
2013-03-12 23:15     ` Greg Kroah-Hartman
2013-03-12 22:43 ` [ 34/40] Fix memory leak in cpufreq stats Greg Kroah-Hartman
2013-03-12 22:43 ` [ 35/40] ftrace: Update the kconfig for DYNAMIC_FTRACE Greg Kroah-Hartman
2013-03-12 22:43 ` Greg Kroah-Hartman [this message]
2013-03-12 22:43 ` [ 37/40] USB: Dont use EHCI port sempahore for USB 3.0 hubs Greg Kroah-Hartman
2013-03-12 22:43 ` [ 38/40] USB: Prepare for refactoring by adding extra udev checks Greg Kroah-Hartman
2013-03-12 22:44 ` [ 39/40] USB: Rip out recursive call on warm port reset Greg Kroah-Hartman
2013-03-12 22:44 ` [ 40/40] Revert "ALSA: hda - hdmi: Make jacks phantom, if theyre not detectable" Greg Kroah-Hartman
2013-03-13  3:57 ` [ 00/40] 3.4.36-stable review Shuah Khan
2013-03-14 13:39 ` Satoru Takeuchi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130312223215.344938494@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=akpm@linux-foundation.org \
    --cc=ben@decadent.org.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tmhikaru@gmail.com \
    --cc=torvalds@linux-foundation.org \
    --cc=zhenzhong.duan@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).