linux-stable.git/drivers/firmware/google/vpd.c, branch linux-5.2.y

firmware: google: check if size is valid when decoding VPD data

2019-09-21T05:18:14+00:00

commit 4b708b7b1a2c09fbdfff6b942ebe3a160213aacd upstream.

The VPD implementation from Chromium Vital Product Data project used to
parse data from untrusted input without checking if the meta data is
invalid or corrupted. For example, the size from decoded content may
be negative value, or larger than whole input buffer. Such invalid data
may cause buffer overflow.

To fix that, the size parameters passed to vpd_decode functions should
be changed to unsigned integer (u32) type, and the parsing of entry
header should be refactored so every size field is correctly verified
before starting to decode.

Fixes: ad2ac9d5c5e0 ("firmware: Google VPD: import lib_vpd source files")
Signed-off-by: Hung-Te Lin 
Cc: stable 
Reviewed-by: Guenter Roeck 
Reviewed-by: Stephen Boyd 
Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.org
Signed-off-by: Greg Kroah-Hartman

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 287

2019-06-05T15:36:37+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license v2 0 as
  published by the free software foundation this program is
  distributed in the hope that it will be useful but without any
  warranty without even the implied warranty of merchantability or
  fitness for a particular purpose see the gnu general public license
  for more details

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 23 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Alexios Zavras 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190529141901.115786599@linutronix.de
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: Drop __iomem usage for memremap() memory

2019-03-27T17:21:29+00:00

memremap() doesn't return an iomem pointer, so we can just use memcpy()
and drop the __iomem annotation here. This silences a sparse warning.

Cc: Guenter Roeck 
Reviewed-by: Guenter Roeck 
Cc: Dmitry Torokhov 
Cc: Anton Vasilyev 
Signed-off-by: Stephen Boyd 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: fix spelling mistake "partion" -> "partition"

2018-09-25T18:20:58+00:00

Trivial fix to spelling mistake in comment

Signed-off-by: Colin Ian King 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: Fix section enabled flag on vpd_section_destroy

2018-08-02T08:34:12+00:00

static struct ro_vpd and rw_vpd are initialized by vpd_sections_init()
in vpd_probe() based on header's ro and rw sizes.
In vpd_remove() vpd_section_destroy() performs deinitialization based
on enabled flag, which is set to true by vpd_sections_init().
This leads to call of vpd_section_destroy() on already destroyed section
for probe-release-probe-release sequence if first probe performs
ro_vpd initialization and second probe does not initialize it.

The patch adds changing enabled flag on vpd_section_destroy and adds
cleanup on the error path of vpd_sections_init.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: Probe via coreboot bus

2018-04-23T11:37:19+00:00

Remove the ad-hoc coreboot table search. Now the driver will only be
probed when the necessary coreboot table entry has already been found.
Furthermore, since the coreboot bus takes care of creating the device, a
separate platform device is no longer needed.

Signed-off-by: Samuel Holland 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: Fix platform driver and device registration/unregistration

2017-11-28T15:57:18+00:00

The driver exit function needs to unregister both platform device and
driver. Also, during registration, register driver first and perform
error checks.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Guenter Roeck 
Cc: stable 
Tested-by: Randy Dunlap 
Reviewed-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: Tie firmware kobject to device lifetime

2017-11-28T15:57:18+00:00

It doesn't make sense to have /sys/firmware/vpd if the device is not
instantiated, so tie its lifetime to the device.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Guenter Roeck 
Cc: stable 
Reviewed-by: Dmitry Torokhov 
Tested-by: Randy Dunlap 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: Destroy vpd sections in remove function

2017-11-28T15:57:18+00:00

vpd sections are initialized during probe and thus should be destroyed
in the remove function.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Cc: stable 
Signed-off-by: Guenter Roeck 
Reviewed-by: Dmitry Torokhov 
Tested-by: Randy Dunlap 
Signed-off-by: Greg Kroah-Hartman

firmware: vpd: use memunmap instead of iounmap

2017-08-28T14:55:47+00:00

In functions vpd_sections_init() and vpd_section_init(), iounmap() is
used to unmap memory. However, in these cases, memunmap() should be
used.

Signed-off-by: Pan Bian 
Reviewed-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman