442f1e746e
Commit4b708b7b1a("firmware: google: check if size is valid when decoding VPD data") adds length checks, but the new vpd_decode_entry() function botched the logic -- it adds the key length twice, instead of adding the key and value lengths separately. On my local system, this means vpd.c's vpd_section_create_attribs() hits an error case after the first attribute it parses, since it's no longer looking at the correct offset. With this patch, I'm back to seeing all the correct attributes in /sys/firmware/vpd/... Fixes:4b708b7b1a("firmware: google: check if size is valid when decoding VPD data") Cc: <stable@vger.kernel.org> Cc: Hung-Te Lin <hungte@chromium.org> Signed-off-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> Link: https://lore.kernel.org/r/20190930214522.240680-1-briannorris@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
99 lines
1.8 KiB
C
99 lines
1.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* vpd_decode.c
|
|
*
|
|
* Google VPD decoding routines.
|
|
*
|
|
* Copyright 2017 Google Inc.
|
|
*/
|
|
|
|
#include "vpd_decode.h"
|
|
|
|
static int vpd_decode_len(const u32 max_len, const u8 *in,
|
|
u32 *length, u32 *decoded_len)
|
|
{
|
|
u8 more;
|
|
int i = 0;
|
|
|
|
if (!length || !decoded_len)
|
|
return VPD_FAIL;
|
|
|
|
*length = 0;
|
|
do {
|
|
if (i >= max_len)
|
|
return VPD_FAIL;
|
|
|
|
more = in[i] & 0x80;
|
|
*length <<= 7;
|
|
*length |= in[i] & 0x7f;
|
|
++i;
|
|
} while (more);
|
|
|
|
*decoded_len = i;
|
|
return VPD_OK;
|
|
}
|
|
|
|
static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
|
|
u32 *_consumed, const u8 **entry, u32 *entry_len)
|
|
{
|
|
u32 decoded_len;
|
|
u32 consumed = *_consumed;
|
|
|
|
if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
|
|
entry_len, &decoded_len) != VPD_OK)
|
|
return VPD_FAIL;
|
|
if (max_len - consumed < decoded_len)
|
|
return VPD_FAIL;
|
|
|
|
consumed += decoded_len;
|
|
*entry = input_buf + consumed;
|
|
|
|
/* entry_len is untrusted data and must be checked again. */
|
|
if (max_len - consumed < *entry_len)
|
|
return VPD_FAIL;
|
|
|
|
consumed += *entry_len;
|
|
*_consumed = consumed;
|
|
return VPD_OK;
|
|
}
|
|
|
|
int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
|
|
vpd_decode_callback callback, void *callback_arg)
|
|
{
|
|
int type;
|
|
u32 key_len;
|
|
u32 value_len;
|
|
const u8 *key;
|
|
const u8 *value;
|
|
|
|
/* type */
|
|
if (*consumed >= max_len)
|
|
return VPD_FAIL;
|
|
|
|
type = input_buf[*consumed];
|
|
|
|
switch (type) {
|
|
case VPD_TYPE_INFO:
|
|
case VPD_TYPE_STRING:
|
|
(*consumed)++;
|
|
|
|
if (vpd_decode_entry(max_len, input_buf, consumed, &key,
|
|
&key_len) != VPD_OK)
|
|
return VPD_FAIL;
|
|
|
|
if (vpd_decode_entry(max_len, input_buf, consumed, &value,
|
|
&value_len) != VPD_OK)
|
|
return VPD_FAIL;
|
|
|
|
if (type == VPD_TYPE_STRING)
|
|
return callback(key, key_len, value, value_len,
|
|
callback_arg);
|
|
break;
|
|
|
|
default:
|
|
return VPD_FAIL;
|
|
}
|
|
|
|
return VPD_OK;
|
|
}
|