linux-kernel - Re: [PATCH] firmware: dmi_scan: Prevent dmi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 27 Mar 2015 14:22:15 +0100
From:	Jean Delvare <jdelvare@...e.de>
To:	Matt Fleming <matt@...eblueprint.co.uk>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Matt Fleming <matt.fleming@...el.com>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	Ivan Khoronzhuk <ivan.khoronzhuk@...aro.org>
Subject: Re: [PATCH] firmware: dmi_scan: Prevent dmi_num integer overflow

Hi Matt,

Le Friday 27 March 2015 à 12:12 +0000, Matt Fleming a écrit :
> On Thu, 26 Mar, at 04:21:53PM, Jean Delvare wrote:
> > Le Thursday 26 March 2015 à 14:47 +0000, Matt Fleming a écrit :
> > > On Thu, 26 Mar, at 02:15:05PM, Jean Delvare wrote:
> > > > 
> > > > I don't actually have a tree, so feel free to pick it.
> > > 
> > > OK will do, but this is a regression fix for a potential bug introduced
> > > in commit 6d9ff4733172 ("firmware: dmi_scan: Fix dmi_len type"), right?
> > 
> > Not really. I'd rather say it complements commit 6d9ff4733172. The
> > actual bugs were introduced in commit fc43026278b2. But you can't really
> > call it a regression as SMBIOS 3.0 entry points were not supported at
> > all before that commit.
>  
> OK, thanks for clarifying.
> 
> > Still a reference to commit fc43026278b2 would certainly be appropriate,
> > as anyone backporting that commit will also want to pick the two
> > aforementioned fix-ups (plus ce204e9a4bd8 for that matter.)
> 
> commit ce204e9a4bd8 and 6d9ff4733172 are already tagged for stable, so
> we should be good there.
> 
> This is what I've got queued up to send to tip today. Feel free to send
> me another version today if you want to word things differently.

Looks good, thanks for taking care of it.

-- 
Jean Delvare
SUSE L3 Support

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/