x86/ucode/amd: Fix more potential buffer overruns with microcode parsing
authorAndrew Cooper <andrew.cooper3@citrix.com>
Fri, 27 Mar 2020 16:50:13 +0000 (16:50 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Wed, 1 Apr 2020 13:00:12 +0000 (14:00 +0100)
commit718d1432000079ea7120f6cb770372afe707ce27
tree72306cd0dde1919da116cdbdfdb8950bdbf1a577
parente0d1871b3d5cfad0f1d8d7c7593bb42929074d08
x86/ucode/amd: Fix more potential buffer overruns with microcode parsing

cpu_request_microcode() doesn't know the buffer is at least 4 bytes long
before inspecting UCODE_MAGIC.

install_equiv_cpu_table() doesn't know the boundary of the buffer it is
interpreting as an equivalency table.  This case was clearly observed at one
point in the past, given the subsequent overrun detection, but without
comprehending that the damage was already done.

Make the logic consistent with container_fast_forward() and pass size_left in
to install_equiv_cpu_table().

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/x86/cpu/microcode/amd.c