AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-18 03:16:47 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

x86/microcode/intel: Fix out of bounds memory access to the extended header

Browse Source 
Improper pointer arithmetics when calculating the address of the
extended header could lead to an out of bounds memory read and kernel
panic.

Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Link: http://lkml.kernel.org/r/20150225094125.GB30434@chrystal.uk.oracle.com
Signed-off-by: Borislav Petkov <bp@suse.de>
This commit is contained in:
Quentin Casasnovas 2015-02-26 18:03:59 +01:00 committed by Borislav Petkov
parent c517d838eb
commit d496a002ae
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
arch/x86/kernel/cpu/microcode/intel_early.c
View File

@ -180,8 +180,7 @@ matching_model_microcode(struct microcode_header_intel *mc_header,
if (total_size <= data_size + MC_HEADER_SIZE)
return UCODE_NFOUND;
ext_header = (struct extended_sigtable *)
mc_header + data_size + MC_HEADER_SIZE;
ext_header = (void *) mc_header + data_size + MC_HEADER_SIZE;
ext_sigcount = ext_header->count;
ext_sig = (void *)ext_header + EXT_HEADER_SIZE;
@ -457,8 +456,7 @@ static void __ref show_saved_mc(void)
if (total_size <= data_size + MC_HEADER_SIZE)
continue;
ext_header = (struct extended_sigtable *)
mc_saved_header + data_size + MC_HEADER_SIZE;
ext_header = (void *) mc_saved_header + data_size + MC_HEADER_SIZE;
ext_sigcount = ext_header->count;
ext_sig = (void *)ext_header + EXT_HEADER_SIZE;