linux-kernel - Re: [PATCH] firmware: dmi: Change size of dmi_ids

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 30 Apr 2024 22:49:46 +0800
From: Tiezhu Yang <yangtiezhu@...ngson.cn>
To: Jean Delvare <jdelvare@...e.de>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [PATCH] firmware: dmi: Change size of dmi_ids_string[] to 256

On 4/29/24 20:44, Jean Delvare wrote:
> Hi Tiezhu,
> 
> Sorry for the very late answer, somehow your messages slipped through
> the cracks.

It does not matter, thank you very much for your reply.

> 
> On Wed, 22 Feb 2023 09:55:01 +0800, Tiezhu Yang wrote:
>> The current size of dmi_ids_string[] is 128, the BIOS date
>> can not be seen if the total string length of system vendor,
>> product name, board name, BIOS version and BIOS date is too
>> long to over 128, it is better and enough to change size of
>> dmi_ids_string[] to 256 for most cases.
> 
> In order to convince me that the size of this buffer needs to be
> increased, one would have to provide a real world example with valid
> DMI data where the output doesn't fit. However...
> 
>> Without this patch:
>>
>> [    0.000000] DMI: Loongson Loongson-3A5000-7A1000-1w-A2101/Loongson-LS3A5000-7A1000-1w-A2101, BIOS vUDK2018-LoongArch-V4.0.05132-beta10 12/13/202
>>
>> With this patch:
>>
>> [    0.000000] DMI: Loongson Loongson-3A5000-7A1000-1w-A2101/Loongson-LS3A5000-7A1000-1w-A2101, BIOS vUDK2018-LoongArch-V4.0.05132-beta10 12/13/2022
> 
> This example is apparently taken from an engineering sample with rather
> "low quality" strings or invalid string indexes. Specifically:
> * The product name and the board name are the exact same string.
> * Both duplicate the system vendor name ("Loongson").
> * The BIOS version includes the architecture name "LoongArch", which
>    seems unnecessarily verbose.
> 
> So my feeling is that the issue would be better addressed by fixing the
> DMI data of your board than increasing the buffer size.

I agree with you.

> 
> Do you have any production-grade DMI table with proper strings where
> the buffer is still not large enough?

Not yet.

I did not find the string length of system vendor, product name,
board name, BIOS version and BIOS date in the spec, I only see
"There is no limit on the length of each individual text string."
in "6.1.3 Text strings", so it may be better to increase the size
to avoid the potential problems in theory at least.

https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.7.0.pdf

Thanks,
Tiezhu