x86, microcode, AMD: Fix broken ucode patch size check
This issue was recently observed on an AMD C-50 CPU where a patch of
maximum size was applied.
Commit be62adb492
("x86, microcode, AMD: Simplify ucode verification")
added current_size in get_matching_microcode(). This is calculated as
size of the ucode patch + 8 (ie. size of the header). Later this is
compared against the maximum possible ucode patch size for a CPU family.
And of course this fails if the patch has already maximum size.
Cc: <stable@vger.kernel.org> [3.3+]
Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Link: http://lkml.kernel.org/r/1344361461-10076-1-git-send-email-bp@amd64.org
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
This commit is contained in:
parent
cb09cad44f
commit
36bf50d769
1 changed files with 4 additions and 3 deletions
|
@ -143,11 +143,12 @@ static int get_matching_microcode(int cpu, const u8 *ucode_ptr,
|
||||||
unsigned int *current_size)
|
unsigned int *current_size)
|
||||||
{
|
{
|
||||||
struct microcode_header_amd *mc_hdr;
|
struct microcode_header_amd *mc_hdr;
|
||||||
unsigned int actual_size;
|
unsigned int actual_size, patch_size;
|
||||||
u16 equiv_cpu_id;
|
u16 equiv_cpu_id;
|
||||||
|
|
||||||
/* size of the current patch we're staring at */
|
/* size of the current patch we're staring at */
|
||||||
*current_size = *(u32 *)(ucode_ptr + 4) + SECTION_HDR_SIZE;
|
patch_size = *(u32 *)(ucode_ptr + 4);
|
||||||
|
*current_size = patch_size + SECTION_HDR_SIZE;
|
||||||
|
|
||||||
equiv_cpu_id = find_equiv_id();
|
equiv_cpu_id = find_equiv_id();
|
||||||
if (!equiv_cpu_id)
|
if (!equiv_cpu_id)
|
||||||
|
@ -174,7 +175,7 @@ static int get_matching_microcode(int cpu, const u8 *ucode_ptr,
|
||||||
/*
|
/*
|
||||||
* now that the header looks sane, verify its size
|
* now that the header looks sane, verify its size
|
||||||
*/
|
*/
|
||||||
actual_size = verify_ucode_size(cpu, *current_size, leftover_size);
|
actual_size = verify_ucode_size(cpu, patch_size, leftover_size);
|
||||||
if (!actual_size)
|
if (!actual_size)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
|
Loading…
Add table
Reference in a new issue