diff options
| author | Thierry Reding <treding@nvidia.com> | 2026-04-30 10:33:56 +0200 |
|---|---|---|
| committer | Thierry Reding <treding@nvidia.com> | 2026-04-30 10:33:56 +0200 |
| commit | 52fcd68c9510ec850b19c6231683f3b726546565 (patch) | |
| tree | 1eff0cbabec862a4cd057e7fbe142d14bf9dbfe2 | |
| parent | 7ff370284fb636104dfa9f9e36fb51e0f8880905 (diff) | |
| parent | 7b1a1af4556a4f95ef273e91435fe804cbfcd223 (diff) | |
| download | linux-next-52fcd68c9510ec850b19c6231683f3b726546565.tar.gz | |
Merge branch 'for-firmware-next' of https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git
| -rw-r--r-- | drivers/firmware/google/coreboot_table.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c index c769631ea15d7..233939e548b44 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -112,16 +112,20 @@ void coreboot_driver_unregister(struct coreboot_driver *driver) } EXPORT_SYMBOL(coreboot_driver_unregister); -static int coreboot_table_populate(struct device *dev, void *ptr) +static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_t len) { int i, ret; void *ptr_entry; struct coreboot_device *device; struct coreboot_table_entry *entry; struct coreboot_table_header *header = ptr; + void *ptr_end; + ptr_end = ptr + len; ptr_entry = ptr + header->header_bytes; for (i = 0; i < header->table_entries; i++) { + if (ptr_entry + sizeof(*entry) > ptr_end) + return -EINVAL; entry = ptr_entry; if (entry->size < sizeof(*entry)) { @@ -129,6 +133,9 @@ static int coreboot_table_populate(struct device *dev, void *ptr) return -EINVAL; } + if (ptr_entry + entry->size > ptr_end) + return -EINVAL; + device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL); if (!device) return -ENOMEM; @@ -194,7 +201,7 @@ static int coreboot_table_probe(struct platform_device *pdev) if (!ptr) return -ENOMEM; - ret = coreboot_table_populate(dev, ptr); + ret = coreboot_table_populate(dev, ptr, len); memunmap(ptr); |