Skip to content

Commit

Permalink
x86, microcode, AMD: Fix section header size check
Browse files Browse the repository at this point in the history
The ucode size check has to take the section header size into account
too when sanity checking the section length. Shorten and clarify define
names, while at it.

Caught-by: Ben Hutchings <ben@decadent.org.uk>
Link: http://lkml.kernel.org/r/1302752223.5282.674.camel@localhost
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
  • Loading branch information
Borislav Petkov committed Jun 16, 2011
1 parent 86b4456 commit 40b7f3d
Showing 1 changed file with 8 additions and 7 deletions.
15 changes: 8 additions & 7 deletions arch/x86/kernel/microcode_amd.c
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,8 @@ struct microcode_amd {
unsigned int mpb[0];
};

#define UCODE_CONTAINER_SECTION_HDR 8
#define UCODE_CONTAINER_HEADER_SIZE 12
#define SECTION_HDR_SIZE 8
#define CONTAINER_HDR_SZ 12

static struct equiv_cpu_entry *equiv_cpu_table;

Expand Down Expand Up @@ -177,7 +177,7 @@ static unsigned int verify_ucode_size(int cpu, const u8 *buf, unsigned int size)

actual_size = *(u32 *)(buf + 4);

if (actual_size > size || actual_size > max_size) {
if (actual_size + SECTION_HDR_SIZE > size || actual_size > max_size) {
pr_err("section size mismatch\n");
return 0;
}
Expand All @@ -204,8 +204,8 @@ get_next_ucode(int cpu, const u8 *buf, unsigned int size, unsigned int *mc_size)
if (!mc)
goto out;

get_ucode_data(mc, buf + UCODE_CONTAINER_SECTION_HDR, actual_size);
*mc_size = actual_size + UCODE_CONTAINER_SECTION_HDR;
get_ucode_data(mc, buf + SECTION_HDR_SIZE, actual_size);
*mc_size = actual_size + SECTION_HDR_SIZE;

out:
return mc;
Expand All @@ -229,9 +229,10 @@ static int install_equiv_cpu_table(const u8 *buf)
return -ENOMEM;
}

get_ucode_data(equiv_cpu_table, buf + UCODE_CONTAINER_HEADER_SIZE, size);
get_ucode_data(equiv_cpu_table, buf + CONTAINER_HDR_SZ, size);

return size + UCODE_CONTAINER_HEADER_SIZE; /* add header length */
/* add header length */
return size + CONTAINER_HDR_SZ;
}

static void free_equiv_cpu_table(void)
Expand Down

0 comments on commit 40b7f3d

Please sign in to comment.