diff --git a/dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present.patch b/dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present.patch new file mode 100644 index 000000000..f105a7e6a --- /dev/null +++ b/dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present.patch @@ -0,0 +1,47 @@ +From: Ben Hutchings +Subject: dmi_scan: fix missing check for _DMI_ signature in smbios_present() + +Commit 9f9c9cbb6057 ('drivers/firmware/dmi_scan.c: fetch dmi version from +SMBIOS if it exists') hoisted the check for "_DMI_" into +dmi_scan_machine(), which means that we don't bother to check for "_DMI_" +at offset 16 in an SMBIOS entry. smbios_present() may also call +dmi_present() for an address where we found "_SM_", if it failed further +validation. + +Check for "_DMI_" in smbios_present() before calling dmi_present(). + +Signed-off-by: Ben Hutchings +Reported-by: Tim McGrath +Tested-by: Tim Mcgrath +Cc: Zhenzhong Duan +Cc: +Signed-off-by: Andrew Morton +--- + + drivers/firmware/dmi_scan.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff -puN drivers/firmware/dmi_scan.c~dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present drivers/firmware/dmi_scan.c +--- a/drivers/firmware/dmi_scan.c~dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present ++++ a/drivers/firmware/dmi_scan.c +@@ -442,7 +442,6 @@ static int __init dmi_present(const char + static int __init smbios_present(const char __iomem *p) + { + u8 buf[32]; +- int offset = 0; + + memcpy_fromio(buf, p, 32); + if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) { +@@ -461,9 +460,9 @@ static int __init smbios_present(const c + dmi_ver = 0x0206; + break; + } +- offset = 16; ++ return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16); + } +- return dmi_present(buf + offset); ++ return 1; + } + + void __init dmi_scan_machine(void) +_ diff --git a/kernel.spec b/kernel.spec index fa047c3c5..cef58e71e 100644 --- a/kernel.spec +++ b/kernel.spec @@ -744,6 +744,9 @@ Patch22266: keys-fix-race-with-concurrent-install_user_keyrings.patch #rhbz 840391 Patch22267: logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch +#rhbz 916444 +Patch22268: dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present.patch + #rhbz 812111 Patch24000: alps.patch @@ -1464,6 +1467,9 @@ ApplyPatch keys-fix-race-with-concurrent-install_user_keyrings.patch #rhbz 840391 ApplyPatch logitech-dj-do-not-directly-call-hid_output_raw_report-during-probe.patch +#rhbz 916444 +ApplyPatch dmi_scan-fix-missing-check-for-_dmi_-signature-in-smbios_present.patch + # END OF PATCH APPLICATIONS %endif @@ -2321,6 +2327,7 @@ fi # '-' %changelog * Thu Mar 07 2013 Josh Boyer +- Fix DMI regression (rhbz 916444) - Fix logitech-dj HID bug from Benjamin Tissoires (rhbz 840391) - CVE-2013-1792 keys: race condition in install_user_keyrings (rhbz 916646 919021)