linux-kernel - Re: Suspect loop in dmi_scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130708163357.GA4752@decadent.org.uk>
Date:	Mon, 8 Jul 2013 17:33:57 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Jean Delvare <jdelvare@...e.de>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: Suspect loop in dmi_scan_machine()

On Mon, Jul 08, 2013 at 05:49:14PM +0200, Jean Delvare wrote:
> Hi Ben,
> 
> I am looking at this commit of yours:
> 
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/drivers/firmware/dmi_scan.c?id=79bae42d51a5d498500c890c19ef76df41d2bf59
> 
> and am a little worried about the for loop in dmi_scan_machine()
> (non-EFI case):
[...]

I don't see any of the bugs you describe.  Let me explain what
I probably should have put in a comment:

We want to find a DMI header at [0xf0000, 0xffff0] and possibly an
SMBIOS header 16 bytes before that.  buf contains a copy of the 32
bytes centred at p.  On the first iteration p - 16 is out of range, so
the first 16 bytes of the buffer are filled with zeroes.

Does that address your concerns?  If not then please explain precisely
how this loop can go wrong.

Ben.

-- 
Ben Hutchings
We get into the habit of living before acquiring the habit of thinking.
                                                              - Albert Camus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/