From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52835C0044C for ; Wed, 7 Nov 2018 17:03:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2558F20827 for ; Wed, 7 Nov 2018 17:03:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2558F20827 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=alien8.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731650AbeKHCfF (ORCPT ); Wed, 7 Nov 2018 21:35:05 -0500 Received: from mail.skyhub.de ([5.9.137.197]:46472 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727870AbeKHCdn (ORCPT ); Wed, 7 Nov 2018 21:33:43 -0500 X-Virus-Scanned: Nedap ESD1 at mail.skyhub.de Received: from mail.skyhub.de ([127.0.0.1]) by localhost (blast.alien8.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id CcPWDb-_F8z6; Wed, 7 Nov 2018 18:02:30 +0100 (CET) Received: from zn.tnic (p200300EC2BCBE000329C23FFFEA6A903.dip0.t-ipconnect.de [IPv6:2003:ec:2bcb:e000:329c:23ff:fea6:a903]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id BD4061EC0291; Wed, 7 Nov 2018 18:02:29 +0100 (CET) From: Borislav Petkov To: X86 ML Cc: "Maciej S . Szmigiero" , Tom Lendacky , LKML Subject: [PATCH 01/16] x86/microcode/AMD: Subtract SECTION_HDR_SIZE from file leftover length Date: Wed, 7 Nov 2018 18:02:03 +0100 Message-Id: <20181107170218.7596-2-bp@alien8.de> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20181107170218.7596-1-bp@alien8.de> References: <20181107170218.7596-1-bp@alien8.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: "Maciej S. Szmigiero" verify_patch_size() verifies whether the remaining size of the microcode container file is large enough to contain a patch of the indicated size. However, the section header length is not included in this indicated size but it is present in the leftover file length so it should be subtracted from the leftover file length before passing this value to verify_patch_size(). Signed-off-by: Maciej S. Szmigiero Cc: x86-ml Link: http://lkml.kernel.org/r/6df43f4f6a28186a13a66e8d7e61143c5e1a2324.1529424596.git.mail@maciej.szmigiero.name [ Split comment. ] Signed-off-by: Borislav Petkov --- arch/x86/kernel/cpu/microcode/amd.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index 07b5fc00b188..b44c9029860c 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -461,8 +461,12 @@ static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig) return 0; } -static unsigned int verify_patch_size(u8 family, u32 patch_size, - unsigned int size) +/* + * Check whether the passed remaining file @size is large enough to contain a + * patch of the indicated @patch_size (and also whether this size does not + * exceed the per-family maximum). + */ +static unsigned int verify_patch_size(u8 family, u32 patch_size, unsigned int size) { u32 max_size; @@ -621,7 +625,12 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover) return crnt_size; } - ret = verify_patch_size(family, patch_size, leftover); + /* + * The section header length is not included in this indicated size + * but is present in the leftover file length so we need to subtract + * it before passing this value to the function below. + */ + ret = verify_patch_size(family, patch_size, leftover - SECTION_HDR_SIZE); if (!ret) { pr_err("Patch-ID 0x%08x: size mismatch.\n", mc_hdr->patch_id); return crnt_size; -- 2.19.1