• Ross Lagerwall's avatar
    efi: cper: Fix possible out-of-bounds access · 45b14a4f
    Ross Lagerwall authored
    When checking a generic status block, we iterate over all the generic
    data blocks. The loop condition only checks that the start of the
    generic data block is valid (within estatus->data_length) but not the
    whole block. Because the size of data blocks (excluding error data) may
    vary depending on the revision and the revision is contained within the
    data block, ensure that enough of the current data block is valid before
    dereferencing any members otherwise an out-of-bounds access may occur if
    estatus->data_length is invalid.
    
    This relies on the fact that struct acpi_hest_generic_data_v300 is a
    superset of the earlier version.  Also rework the other checks to avoid
    potential underflow.
    Signed-off-by: default avatarRoss Lagerwall <ross.lagerwall@citrix.com>
    Acked-by: default avatarBorislav Petkov <bp@suse.de>
    Tested-by: default avatarTyler Baicar <baicar.tyler@gmail.com>
    Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
    45b14a4f
cper.c 17.7 KB