Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging

37b238da · Linus Torvalds <[email protected]> · 2019-10-15 09:20:07 -07:00

Pull dmi fix from Jean Delvare.

* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices

Commit: 37b238da15a87a0be1cdda09e4aa8a5bc2b4d759
Parents: 5bc52f64 · 81dde26d

Merge commit. Changes below are compared with the first parent: 5bc52f64.

Changes

1 files changed · +1 −1

File	Status	Add	Del	Content
drivers/firmware/dmi_scan.c	modified	+1	−1	View file

drivers/firmware/dmi_scan.c

View file

diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 35ed56b..1e21fc3 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -408,7 +408,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
 		bytes = ~0ull;
 	else if (size & 0x8000)
 		bytes = (u64)(size & 0x7fff) << 10;
-	else if (size != 0x7fff)
+	else if (size != 0x7fff || dm->length < 0x20)
 		bytes = (u64)size << 20;
 	else
 		bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;