x86/ucode/amd: Fix more potential buffer overruns with microcode parsing
authorAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 9 Apr 2020 08:17:10 +0000 (10:17 +0200)
committerJan Beulich <jbeulich@suse.com>
Thu, 9 Apr 2020 08:17:10 +0000 (10:17 +0200)
commit4b4ec479731f6cbb9f9c11b5c0f6ab391c2e193d
tree49552986603f88964f2e234a07acc8d53835357f
parent8f51dad75bcbf6b4b7954f27e9cec92742eb8c15
x86/ucode/amd: Fix more potential buffer overruns with microcode parsing

cpu_request_microcode() doesn't know the buffer is at least 4 bytes long
before inspecting UCODE_MAGIC.

install_equiv_cpu_table() doesn't know the boundary of the buffer it is
interpreting as an equivalency table.  This case was clearly observed at one
point in the past, given the subsequent overrun detection, but without
comprehending that the damage was already done.

Make the logic consistent with container_fast_forward() and pass size_left in
to install_equiv_cpu_table().

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
master commit: 718d1432000079ea7120f6cb770372afe707ce27
master date: 2020-04-01 14:00:12 +0100
xen/arch/x86/microcode_amd.c