x86/ucode/amd: Fix buffer overrun with equiv table handling

Commit Message

Andrew Cooper March 27, 2020, 11:59 a.m. UTC

find_equiv_cpu_id() loops until it finds a 0 installed_cpu entry.  Well formed
AMD microcode containers have this property.

Extend the checking in install_equiv_cpu_table() to reject tables which don't
have a sentinal at the end.

Signed-off-by: Andrew Cooper <[e-mail]>
---
CC: Jan Beulich <[e-mail]>
CC: Wei Liu <[e-mail]>
CC: Roger Pau Monné <[e-mail]>

All of this logic needs rewriting, but this is the minimally invasive version
for backport.
---
 xen/arch/x86/cpu/microcode/amd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Jan Beulich March 27, 2020, 12:36 p.m. UTC | #1

On 27.03.2020 12:59, Andrew Cooper wrote:
> find_equiv_cpu_id() loops until it finds a 0 installed_cpu entry.  Well formed
> AMD microcode containers have this property.

With this, would you mind adding "potential" to the subject?

> Extend the checking in install_equiv_cpu_table() to reject tables which don't
> have a sentinal at the end.
> 
> Signed-off-by: Andrew Cooper <[e-mail]>

Reviewed-by: Jan Beulich <[e-mail]>

Patch

diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
index b8b83d248d..9fe1a3c941 100644
--- a/xen/arch/x86/cpu/microcode/amd.c
+++ b/xen/arch/x86/cpu/microcode/amd.c
@@ -310,6 +310,7 @@  static int install_equiv_cpu_table(
     size_t *offset)
 {
     const struct mpbhdr *mpbuf = data + *offset + 4;
+    const struct equiv_cpu_entry *eq;
 
     *offset += mpbuf->len + CONT_HDR_SIZE;	/* add header length */
 
@@ -319,7 +320,9 @@  static int install_equiv_cpu_table(
         return -EINVAL;
     }
 
-    if ( mpbuf->len == 0 )
+    if ( mpbuf->len == 0 || mpbuf->len % sizeof(*eq) ||
+         (eq = (const void *)mpbuf->data,
+          eq[(mpbuf->len / sizeof(*eq)) - 1].installed_cpu) )
     {
         printk(KERN_ERR "microcode: Wrong microcode equivalent cpu table length\n");
         return -EINVAL;