tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kern/acpi: Fix out of bounds access in grub_acpi_xsdt_find_table()

Browse Source 
The calculation of the size of the table was incorrect (copy/pasta from
grub_acpi_rsdt_find_table() I assume...). The entries are 64-bit long.

This causes us to access beyond the end of the table which is causing
crashes during boot on some systems. Typically this is causing a crash
on VMWare when using UEFI and enabling serial autodetection, as

  grub_acpi_find_table (GRUB_ACPI_SPCR_SIGNATURE);

will goes past the end of the table (the SPCR table doesn't exits).

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Vladimir Serbinenko <phcoder@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
Tested-by: Renata Ravanelli <rravanel@redhat.com>
This commit is contained in:
Benjamin Herrenschmidt 2024-10-16 16:20:24 +11:00 committed by Daniel Kiper
parent f5bb766e68
commit 31de991dee
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
grub-core/kern/acpi.c
View File

@ -75,7 +75,7 @@ grub_acpi_xsdt_find_table (struct grub_acpi_table_header *xsdt, const char *sig)
return 0;
ptr = (grub_unaligned_uint64_t *) (xsdt + 1);
s = (xsdt->length - sizeof (*xsdt)) / sizeof (grub_uint32_t);
s = (xsdt->length - sizeof (*xsdt)) / sizeof (grub_uint64_t);
for (; s; s--, ptr++)
{
struct grub_acpi_table_header *tbl;