linux-kernel - Re: [PATCH v5 6/6] x86/microcode/AMD: Check the equivalence table size when scanning it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180430090542.GD6509@pd.tnic>
Date:   Mon, 30 Apr 2018 11:05:42 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     "Maciej S. Szmigiero" <mail@...iej.szmigiero.name>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5 6/6] x86/microcode/AMD: Check the equivalence table
 size when scanning it

On Mon, Apr 23, 2018 at 11:34:11PM +0200, Maciej S. Szmigiero wrote:
> Currently, the code scanning the CPU equivalence table read from a
> microcode container file assumes that it actually contains a terminating
> zero entry.
> Let's check also the size of this table to make sure that we don't read
> past it in case it actually doesn't.

...

> @@ -697,6 +706,7 @@ static unsigned int install_equiv_cpu_table(const u8 *buf, size_t buf_size)
>  	}
>  
>  	memcpy(equiv_cpu_table, buf + CONTAINER_HDR_SZ, equiv_tbl_len);
> +	equiv_cpu_table_entries = equiv_tbl_len / sizeof(struct equiv_cpu_entry);
>  
>  	return equiv_tbl_len;

Instead of adding yet another global var which needs handling too,
and touching so many places, just do all checks and preparations in
install_equiv_cpu_table() so that the rest of the code can get what it
expects: terminating zero entry and proper size.

Thx.

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.