[PATCH AUTOSEL for 3.18 032/101] firmware: dmi_scan: Check DMI structure length

[Sasha Levin]

From: Jean Delvare <jdelv...@suse.de>

[ Upstream commit a814c3597a6b6040e2ef9459748081a6d5b7312d ]

Before accessing DMI data to record it for later, we should ensure
that the DMI structures are large enough to contain the data in
question.

Signed-off-by: Jean Delvare <jdelv...@suse.de>
Reviewed-by: Mika Westerberg <mika.westerb...@linux.intel.com>
Cc: Dmitry Torokhov <dmitry.torok...@gmail.com>
Cc: Andy Shevchenko <andy.shevche...@gmail.com>
Cc: Linus Walleij <linus.wall...@linaro.org>
Signed-off-by: Sasha Levin <alexander.le...@microsoft.com>
---
 drivers/firmware/dmi_scan.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 35286fe52823..f4dbe6fe9dd9 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -152,7 +152,7 @@ static void __init dmi_save_ident(const struct dmi_header 
*dm, int slot,
        const char *d = (const char *) dm;
        const char *p;
 
-       if (dmi_ident[slot])
+       if (dmi_ident[slot] || dm->length <= string)
                return;
 
        p = dmi_string(dm, d[string]);
@@ -165,13 +165,14 @@ static void __init dmi_save_ident(const struct dmi_header 
*dm, int slot,
 static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
                int index)
 {
-       const u8 *d = (u8 *) dm + index;
+       const u8 *d;
        char *s;
        int is_ff = 1, is_00 = 1, i;
 
-       if (dmi_ident[slot])
+       if (dmi_ident[slot] || dm->length <= index + 16)
                return;
 
+       d = (u8 *) dm + index;
        for (i = 0; i < 16 && (is_ff || is_00); i++) {
                if (d[i] != 0x00)
                        is_00 = 0;
@@ -202,16 +203,17 @@ static void __init dmi_save_uuid(const struct dmi_header 
*dm, int slot,
 static void __init dmi_save_type(const struct dmi_header *dm, int slot,
                int index)
 {
-       const u8 *d = (u8 *) dm + index;
+       const u8 *d;
        char *s;
 
-       if (dmi_ident[slot])
+       if (dmi_ident[slot] || dm->length <= index)
                return;
 
        s = dmi_alloc(4);
        if (!s)
                return;
 
+       d = (u8 *) dm + index;
        sprintf(s, "%u", *d & 0x7F);
        dmi_ident[slot] = s;
 }
@@ -252,9 +254,13 @@ static void __init dmi_save_devices(const struct 
dmi_header *dm)
 
 static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)
 {
-       int i, count = *(u8 *)(dm + 1);
+       int i, count;
        struct dmi_device *dev;
 
+       if (dm->length < 0x05)
+               return;
+
+       count = *(u8 *)(dm + 1);
        for (i = 1; i <= count; i++) {
                const char *devname = dmi_string(dm, i);
 
@@ -321,6 +327,9 @@ static void __init dmi_save_extended_devices(const struct 
dmi_header *dm)
 {
        const u8 *d = (u8 *) dm + 5;
 
+       if (dm->length < 0x0B)
+               return;
+
        /* Skip disabled device */
        if ((*d & 0x80) == 0)
                return;
@@ -342,7 +351,7 @@ static void __init save_mem_devices(const struct dmi_header 
*dm, void *v)
        const char *d = (const char *)dm;
        static int nr;
 
-       if (dm->type != DMI_ENTRY_MEM_DEVICE)
+       if (dm->type != DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)
                return;
        if (nr >= dmi_memdev_nr) {
                pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");
-- 
2.15.1