diff options
| author | Ingo Molnar <mingo@kernel.org> | 2015-02-19 07:32:42 -0500 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2015-02-19 07:32:42 -0500 |
| commit | 1fbe23e0dea54e30f39f26ae90150ea7ebb48f79 (patch) | |
| tree | a84deaf377b40a2f047e1ee2b8b3f3ea78c8b030 /arch/x86 | |
| parent | a267b0a349bb021c010e36a2a13e1e16657b1b0f (diff) | |
| parent | 35a9ff4eec7a1725ac4364972fc6c156e4feedd0 (diff) | |
Merge tag 'microcode_fixes_for-3.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp into x86/urgent
Pull microcode fixes from Borislav Petkov:
- Two fixes hardening microcode data handling. (Quentin Casasnovas)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'arch/x86')
| -rw-r--r-- | arch/x86/kernel/cpu/microcode/intel.c | 5 | ||||
| -rw-r--r-- | arch/x86/kernel/cpu/microcode/intel_early.c | 6 |
2 files changed, 10 insertions, 1 deletions
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c index c6826d1e8082..746e7fd08aad 100644 --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c | |||
| @@ -196,6 +196,11 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, | |||
| 196 | struct microcode_header_intel mc_header; | 196 | struct microcode_header_intel mc_header; |
| 197 | unsigned int mc_size; | 197 | unsigned int mc_size; |
| 198 | 198 | ||
| 199 | if (leftover < sizeof(mc_header)) { | ||
| 200 | pr_err("error! Truncated header in microcode data file\n"); | ||
| 201 | break; | ||
| 202 | } | ||
| 203 | |||
| 199 | if (get_ucode_data(&mc_header, ucode_ptr, sizeof(mc_header))) | 204 | if (get_ucode_data(&mc_header, ucode_ptr, sizeof(mc_header))) |
| 200 | break; | 205 | break; |
| 201 | 206 | ||
diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c index ec9df6f9cd47..420eb933189c 100644 --- a/arch/x86/kernel/cpu/microcode/intel_early.c +++ b/arch/x86/kernel/cpu/microcode/intel_early.c | |||
| @@ -321,7 +321,11 @@ get_matching_model_microcode(int cpu, unsigned long start, | |||
| 321 | unsigned int mc_saved_count = mc_saved_data->mc_saved_count; | 321 | unsigned int mc_saved_count = mc_saved_data->mc_saved_count; |
| 322 | int i; | 322 | int i; |
| 323 | 323 | ||
| 324 | while (leftover) { | 324 | while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) { |
| 325 | |||
| 326 | if (leftover < sizeof(mc_header)) | ||
| 327 | break; | ||
| 328 | |||
| 325 | mc_header = (struct microcode_header_intel *)ucode_ptr; | 329 | mc_header = (struct microcode_header_intel *)ucode_ptr; |
| 326 | 330 | ||
| 327 | mc_size = get_totalsize(mc_header); | 331 | mc_size = get_totalsize(mc_header); |