Before reading the Extended Size field, we should ensure it fits in the DMI record. There is already a record length check but it does not cover that field.
It would take a seriously corrupted DMI table to hit that bug, so no need to worry, but we should still fix it. Signed-off-by: Jean Delvare <jdelv...@suse.de> Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size") Cc: Tony Luck <tony.l...@intel.com> Cc: Borislav Petkov <b...@suse.de> --- drivers/firmware/dmi_scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- linux-5.3.orig/drivers/firmware/dmi_scan.c 2019-10-04 16:14:24.575714482 +0200 +++ linux-5.3/drivers/firmware/dmi_scan.c 2019-10-04 16:18:18.878669652 +0200 @@ -408,7 +408,7 @@ static void __init save_mem_devices(cons bytes = ~0ull; else if (size & 0x8000) bytes = (u64)(size & 0x7fff) << 10; - else if (size != 0x7fff) + else if (size != 0x7fff || dm->length < 0x20) bytes = (u64)size << 20; else bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20; -- Jean Delvare SUSE L3 Support