From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750946AbbDZUrc (ORCPT ); Sun, 26 Apr 2015 16:47:32 -0400 Received: from cantor2.suse.de ([195.135.220.15]:42607 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750746AbbDZUrb (ORCPT ); Sun, 26 Apr 2015 16:47:31 -0400 Date: Sun, 26 Apr 2015 22:47:26 +0200 From: Jean Delvare To: LKML Cc: Roy Franz , Ivan Khoronzhuk , Matt Fleming Subject: [PATCH] firmware: dmi_scan: Trim DMI table length before exporting it Message-ID: <20150426224726.19888863@endymion.delvare> Organization: SUSE Linux X-Mailer: Claws Mail 3.10.1 (GTK+ 2.24.23; x86_64-suse-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The SMBIOS v3 entry points specify a maximum length for the DMI table, not the exact length. Thus there may be garbage after the end-of-table marker, which we don't want to export to user-space. Adjust dmi_len when we find the end-of-table marker, so that only the actual table payload is exported. Signed-off-by: Jean Delvare Cc: Ivan Khoronzhuk --- drivers/firmware/dmi_scan.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) --- linux-4.1-rc0.orig/drivers/firmware/dmi_scan.c 2015-04-26 18:56:15.657111185 +0200 +++ linux-4.1-rc0/drivers/firmware/dmi_scan.c 2015-04-26 22:42:59.183547584 +0200 @@ -108,15 +108,19 @@ static void dmi_decode_table(u8 *buf, if (data - buf < dmi_len - 1) decode(dm, private_data); + data += 2; + i++; + /* * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0] */ if (dm->type == DMI_ENTRY_END_OF_TABLE) break; - - data += 2; - i++; } + + /* Trim DMI table length if needed */ + if (dmi_len > data - buf) + dmi_len = data - buf; } static phys_addr_t dmi_base; @@ -125,8 +129,9 @@ static int __init dmi_walk_early(void (* void *)) { u8 *buf; + u32 orig_dmi_len = dmi_len; - buf = dmi_early_remap(dmi_base, dmi_len); + buf = dmi_early_remap(dmi_base, orig_dmi_len); if (buf == NULL) return -1; @@ -134,7 +139,7 @@ static int __init dmi_walk_early(void (* add_device_randomness(buf, dmi_len); - dmi_early_unmap(buf, dmi_len); + dmi_early_unmap(buf, orig_dmi_len); return 0; } -- Jean Delvare SUSE L3 Support