diff options
| author |   Linus Torvalds <torvalds@linux-foundation.org> | 2022-10-11 10:44:20 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2022-10-11 10:44:20 -0700 |
| commit | 500b717fe36f31eec487adae4824f9be7c48d998 (patch) | |
| tree | 0fd9ebda2a42147e737b16d855afa55d44919bd1 /drivers/firmware | |
| parent | Merge tag 'for-linus-6.1-1' of https://github.com/cminyard/linux-ipmi (diff) | |
| parent | firmware: dmi: Fortify entry point length checks (diff) | |
| download | linux-dev-500b717fe36f31eec487adae4824f9be7c48d998.tar.xz linux-dev-500b717fe36f31eec487adae4824f9be7c48d998.zip | |
Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
Pull dmi updates from Jean Delvare.
* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
firmware: dmi: Fortify entry point length checks
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/dmi_scan.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c index 0eb6b617f709..015c95a825d3 100644 --- a/drivers/firmware/dmi_scan.c +++ b/drivers/firmware/dmi_scan.c @@ -567,8 +567,13 @@ static int __init dmi_present(const u8 *buf) { u32 smbios_ver; + /* + * The size of this structure is 31 bytes, but we also accept value + * 30 due to a mistake in SMBIOS specification version 2.1. + */ if (memcmp(buf, "_SM_", 4) == 0 && - buf[5] < 32 && dmi_checksum(buf, buf[5])) { + buf[5] >= 30 && buf[5] <= 32 && + dmi_checksum(buf, buf[5])) { smbios_ver = get_unaligned_be16(buf + 6); smbios_entry_point_size = buf[5]; memcpy(smbios_entry_point, buf, smbios_entry_point_size); @@ -629,7 +634,8 @@ static int __init dmi_present(const u8 *buf) static int __init dmi_smbios3_present(const u8 *buf) { if (memcmp(buf, "_SM3_", 5) == 0 && - buf[6] < 32 && dmi_checksum(buf, buf[6])) { + buf[6] >= 24 && buf[6] <= 32 && + dmi_checksum(buf, buf[6])) { dmi_ver = get_unaligned_be24(buf + 7); dmi_num = 0; /* No longer specified */ dmi_len = get_unaligned_le32(buf + 12); |