diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-01-14 10:04:00 -0600 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-01-14 10:04:00 -0600 |
| commit | 880ca43e5c334c32a8af125e456d1a23314aa416 (patch) | |
| tree | 069120514640c3e994bd700eb93d055b2b124917 /drivers/firmware/google/coreboot_table.c | |
| parent | 8b7be52f3f0d0c24ee147ba7cab6c7fa4f9bcfbb (diff) | |
| parent | 42633ed852deadc14d44660ad71e2f6640239120 (diff) | |
| download | linux-880ca43e5c334c32a8af125e456d1a23314aa416.tar.bz2 | |
Merge tag 'hardening-v6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull kernel hardening fixes from Kees Cook:
- Fix CFI hash randomization with KASAN (Sami Tolvanen)
- Check size of coreboot table entry and use flex-array
* tag 'hardening-v6.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
kbuild: Fix CFI hash randomization with KASAN
firmware: coreboot: Check size of table entry and use flex-array
Diffstat (limited to 'drivers/firmware/google/coreboot_table.c')
| -rw-r--r-- | drivers/firmware/google/coreboot_table.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c index 2652c396c423..33ae94745aef 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -93,14 +93,19 @@ static int coreboot_table_populate(struct device *dev, void *ptr) for (i = 0; i < header->table_entries; i++) { entry = ptr_entry; - device = kzalloc(sizeof(struct device) + entry->size, GFP_KERNEL); + if (entry->size < sizeof(*entry)) { + dev_warn(dev, "coreboot table entry too small!\n"); + return -EINVAL; + } + + device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL); if (!device) return -ENOMEM; device->dev.parent = dev; device->dev.bus = &coreboot_bus_type; device->dev.release = coreboot_device_release; - memcpy(&device->entry, ptr_entry, entry->size); + memcpy(device->raw, ptr_entry, entry->size); switch (device->entry.tag) { case LB_TAG_CBMEM_ENTRY: |