Commit 55cc6fe5 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by Rafael J. Wysocki
Browse files

EFI/CPER: don't dump the entire memory region 



The current logic at cper_print_fw_err() doesn't check if the
error record length is big enough to handle offset. On a bad firmware,
if the ofset is above the actual record, length -= offset will
underflow, making it dump the entire memory.

The end result can be:

 - the logic taking a lot of time dumping large regions of memory;
 - data disclosure due to the memory dumps;
 - an OOPS, if it tries to dump an unmapped memory region.

Fix it by checking if the section length is too small before doing
a hex dump.

Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: default avatarJonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: default avatarArd Biesheuvel <ardb@kernel.org>
Reviewed-by: default avatarHanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org


Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent fa2408a2

drivers/firmware/efi/cper.c

+5 −0
Original line number Diff line number Diff line
@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx, 
	} else {

		offset = sizeof(*fw_err);

	}

	if (offset > length) {

		printk("%s""error section length is too small: offset=%d, length=%d\n",

		       pfx, offset, length);

		return;

	}



	buf += offset;

	length -= offset;