[xen stable-4.13] x86/ucode/amd: Fix potential buffer overrun with equiv table handling

[patchbot@xxxxxxx]

commit c7a1e588d85c01e2e8a979ebd7c2277c73c13d6e
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Apr 9 09:17:11 2020 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Apr 9 09:17:11 2020 +0200

    x86/ucode/amd: Fix potential buffer overrun with equiv table handling
    
    find_equiv_cpu_id() loops until it finds a 0 installed_cpu entry.  Well 
formed
    AMD microcode containers have this property.
    
    Extend the checking in install_equiv_cpu_table() to reject tables which 
don't
    have a sentinal at the end.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 1f97b6b9f1b5978659c5735954c37c130e7bb151
    master date: 2020-03-27 13:13:26 +0000
---
 xen/arch/x86/microcode_amd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/microcode_amd.c b/xen/arch/x86/microcode_amd.c
index 4931a725ea..5d85b94575 100644
--- a/xen/arch/x86/microcode_amd.c
+++ b/xen/arch/x86/microcode_amd.c
@@ -321,6 +321,7 @@ static int install_equiv_cpu_table(
     size_t *offset)
 {
     const struct mpbhdr *mpbuf = data + *offset + 4;
+    const struct equiv_cpu_entry *eq;
 
     *offset += mpbuf->len + CONT_HDR_SIZE;     /* add header length */
 
@@ -330,7 +331,9 @@ static int install_equiv_cpu_table(
         return -EINVAL;
     }
 
-    if ( mpbuf->len == 0 )
+    if ( mpbuf->len == 0 || mpbuf->len % sizeof(*eq) ||
+         (eq = (const void *)mpbuf->data,
+          eq[(mpbuf->len / sizeof(*eq)) - 1].installed_cpu) )
     {
         printk(KERN_ERR "microcode: Wrong microcode equivalent cpu table 
length\n");
         return -EINVAL;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.13