mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-21 12:49:08 +07:00
4b708b7b1a
The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.
To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.
Fixes: ad2ac9d5c5 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin <hungte@chromium.org>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
99 lines
1.8 KiB
C
99 lines
1.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* vpd_decode.c
|
|
*
|
|
* Google VPD decoding routines.
|
|
*
|
|
* Copyright 2017 Google Inc.
|
|
*/
|
|
|
|
#include "vpd_decode.h"
|
|
|
|
static int vpd_decode_len(const u32 max_len, const u8 *in,
|
|
u32 *length, u32 *decoded_len)
|
|
{
|
|
u8 more;
|
|
int i = 0;
|
|
|
|
if (!length || !decoded_len)
|
|
return VPD_FAIL;
|
|
|
|
*length = 0;
|
|
do {
|
|
if (i >= max_len)
|
|
return VPD_FAIL;
|
|
|
|
more = in[i] & 0x80;
|
|
*length <<= 7;
|
|
*length |= in[i] & 0x7f;
|
|
++i;
|
|
} while (more);
|
|
|
|
*decoded_len = i;
|
|
return VPD_OK;
|
|
}
|
|
|
|
static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
|
|
u32 *_consumed, const u8 **entry, u32 *entry_len)
|
|
{
|
|
u32 decoded_len;
|
|
u32 consumed = *_consumed;
|
|
|
|
if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
|
|
entry_len, &decoded_len) != VPD_OK)
|
|
return VPD_FAIL;
|
|
if (max_len - consumed < decoded_len)
|
|
return VPD_FAIL;
|
|
|
|
consumed += decoded_len;
|
|
*entry = input_buf + consumed;
|
|
|
|
/* entry_len is untrusted data and must be checked again. */
|
|
if (max_len - consumed < *entry_len)
|
|
return VPD_FAIL;
|
|
|
|
consumed += decoded_len;
|
|
*_consumed = consumed;
|
|
return VPD_OK;
|
|
}
|
|
|
|
int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
|
|
vpd_decode_callback callback, void *callback_arg)
|
|
{
|
|
int type;
|
|
u32 key_len;
|
|
u32 value_len;
|
|
const u8 *key;
|
|
const u8 *value;
|
|
|
|
/* type */
|
|
if (*consumed >= max_len)
|
|
return VPD_FAIL;
|
|
|
|
type = input_buf[*consumed];
|
|
|
|
switch (type) {
|
|
case VPD_TYPE_INFO:
|
|
case VPD_TYPE_STRING:
|
|
(*consumed)++;
|
|
|
|
if (vpd_decode_entry(max_len, input_buf, consumed, &key,
|
|
&key_len) != VPD_OK)
|
|
return VPD_FAIL;
|
|
|
|
if (vpd_decode_entry(max_len, input_buf, consumed, &value,
|
|
&value_len) != VPD_OK)
|
|
return VPD_FAIL;
|
|
|
|
if (type == VPD_TYPE_STRING)
|
|
return callback(key, key_len, value, value_len,
|
|
callback_arg);
|
|
break;
|
|
|
|
default:
|
|
return VPD_FAIL;
|
|
}
|
|
|
|
return VPD_OK;
|
|
}
|