Now that we have the PATCH_MAX_SIZE macro correctly computed we can verify
properly the indicated size of a patch in a microcode container file and
whether this file is actually large enough to contain it in the late loader
verify_and_add_patch() function.

The early loader already does the PATCH_MAX_SIZE check in parse_container()
function.

Signed-off-by: Maciej S. Szmigiero <m...@maciej.szmigiero.name>
---
 arch/x86/kernel/cpu/microcode/amd.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c 
b/arch/x86/kernel/cpu/microcode/amd.c
index b9f6c06bdc16..0f78200f2f6c 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -485,7 +485,7 @@ static int collect_cpu_info_amd(int cpu, struct 
cpu_signature *csig)
 }
 
 static unsigned int verify_patch_size(u8 family, u32 patch_size,
-                                     unsigned int size)
+                                     size_t size)
 {
        u32 max_size;
 
@@ -507,7 +507,7 @@ static unsigned int verify_patch_size(u8 family, u32 
patch_size,
                break;
        }
 
-       if (patch_size > min_t(u32, size, max_size)) {
+       if (patch_size > min_t(size_t, size, max_size)) {
                pr_err("patch size mismatch\n");
                return 0;
        }
@@ -616,7 +616,7 @@ static void cleanup(void)
  * driver cannot continue functioning normally. In such cases, we tear
  * down everything we've used up so far and exit.
  */
-static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover)
+static int verify_and_add_patch(u8 family, u8 *fw, size_t leftover)
 {
        struct microcode_header_amd *mc_hdr;
        struct ucode_patch *patch;
@@ -624,7 +624,15 @@ static int verify_and_add_patch(u8 family, u8 *fw, 
unsigned int leftover)
        u32 proc_fam;
        u16 proc_id;
 
+       if (leftover < SECTION_HDR_SIZE + sizeof(*mc_hdr))
+               return leftover;
+
        patch_size  = *(u32 *)(fw + 4);
+       if (patch_size > PATCH_MAX_SIZE) {
+               pr_err("patch size %u too large\n", patch_size);
+               return -EINVAL;
+       }
+
        crnt_size   = patch_size + SECTION_HDR_SIZE;
        mc_hdr      = (struct microcode_header_amd *)(fw + SECTION_HDR_SIZE);
        proc_id     = mc_hdr->processor_rev_id;

Reply via email to