* [Xen-devel] [PATCH] x86/ucode/amd: Fix buffer overrun with equiv table handling
@ 2020-03-27 11:59 Andrew Cooper
2020-03-27 12:36 ` Jan Beulich
0 siblings, 1 reply; 2+ messages in thread
From: Andrew Cooper @ 2020-03-27 11:59 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich, Roger Pau Monné
find_equiv_cpu_id() loops until it finds a 0 installed_cpu entry. Well formed
AMD microcode containers have this property.
Extend the checking in install_equiv_cpu_table() to reject tables which don't
have a sentinal at the end.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Wei Liu <wl@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
All of this logic needs rewriting, but this is the minimally invasive version
for backport.
---
xen/arch/x86/cpu/microcode/amd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
index b8b83d248d..9fe1a3c941 100644
--- a/xen/arch/x86/cpu/microcode/amd.c
+++ b/xen/arch/x86/cpu/microcode/amd.c
@@ -310,6 +310,7 @@ static int install_equiv_cpu_table(
size_t *offset)
{
const struct mpbhdr *mpbuf = data + *offset + 4;
+ const struct equiv_cpu_entry *eq;
*offset += mpbuf->len + CONT_HDR_SIZE; /* add header length */
@@ -319,7 +320,9 @@ static int install_equiv_cpu_table(
return -EINVAL;
}
- if ( mpbuf->len == 0 )
+ if ( mpbuf->len == 0 || mpbuf->len % sizeof(*eq) ||
+ (eq = (const void *)mpbuf->data,
+ eq[(mpbuf->len / sizeof(*eq)) - 1].installed_cpu) )
{
printk(KERN_ERR "microcode: Wrong microcode equivalent cpu table length\n");
return -EINVAL;
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Xen-devel] [PATCH] x86/ucode/amd: Fix buffer overrun with equiv table handling
2020-03-27 11:59 [Xen-devel] [PATCH] x86/ucode/amd: Fix buffer overrun with equiv table handling Andrew Cooper
@ 2020-03-27 12:36 ` Jan Beulich
0 siblings, 0 replies; 2+ messages in thread
From: Jan Beulich @ 2020-03-27 12:36 UTC (permalink / raw)
To: Andrew Cooper; +Cc: Xen-devel, Wei Liu, Roger Pau Monné
On 27.03.2020 12:59, Andrew Cooper wrote:
> find_equiv_cpu_id() loops until it finds a 0 installed_cpu entry. Well formed
> AMD microcode containers have this property.
With this, would you mind adding "potential" to the subject?
> Extend the checking in install_equiv_cpu_table() to reject tables which don't
> have a sentinal at the end.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-27 12:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-27 11:59 [Xen-devel] [PATCH] x86/ucode/amd: Fix buffer overrun with equiv table handling Andrew Cooper
2020-03-27 12:36 ` Jan Beulich
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.