diff options
| author | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2026-01-08 14:35:06 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 15:20:14 +0300 |
| commit | 64ae5aaa7ac93c83da456039e8ec747bfa8a7cff (patch) | |
| tree | 9b26f4381113a3baaf4535c787269c42a66c8e08 /drivers/firmware | |
| parent | acd8d076e8c90c8603d6792ece51018198ae7391 (diff) | |
| download | linux-64ae5aaa7ac93c83da456039e8ec747bfa8a7cff.tar.xz | |
EFI/CPER: don't dump the entire memory region
[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
The current logic at cper_print_fw_err() doesn't check if the
error record length is big enough to handle offset. On a bad firmware,
if the ofset is above the actual record, length -= offset will
underflow, making it dump the entire memory.
The end result can be:
- the logic taking a lot of time dumping large regions of memory;
- data disclosure due to the memory dumps;
- an OOPS, if it tries to dump an unmapped memory region.
Fix it by checking if the section length is too small before doing
a hex dump.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/efi/cper.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c index 9d6650f50ffe..f0e8ee2641b8 100644 --- a/drivers/firmware/efi/cper.c +++ b/drivers/firmware/efi/cper.c @@ -551,6 +551,11 @@ static void cper_print_fw_err(const char *pfx, } else { offset = sizeof(*fw_err); } + if (offset > length) { + printk("%s""error section length is too small: offset=%d, length=%d\n", + pfx, offset, length); + return; + } buf += offset; length -= offset; |