[PATCH] Fix two problems in the microcode parsers

[Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx>]

The microcode might come from a questionable source, so it is necessary
for the parsers to treat it as untrusted.  The CPU will validate the
microcode before applying it, so loading microcode from unofficial
sources is actually a legitimate thing to do in some cases.

Signed-off-by: Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx>
---
 xen/arch/x86/cpu/microcode/amd.c   | 1 +
 xen/arch/x86/cpu/microcode/intel.c | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
index 
d2a26967c6dbc4695602dd46d5836a6d88e15072..31ee5717c5f1c7d0b7e29d990cf4d1024d775900
 100644
--- a/xen/arch/x86/cpu/microcode/amd.c
+++ b/xen/arch/x86/cpu/microcode/amd.c
@@ -338,6 +338,7 @@ static struct microcode_patch *cf_check 
cpu_request_microcode(
         if ( size < sizeof(*et) ||
              (et = buf)->type != UCODE_EQUIV_CPU_TABLE_TYPE ||
              size - sizeof(*et) < et->len ||
+             et->len < sizeof(et->eq[0]) ||
              et->len % sizeof(et->eq[0]) ||
              et->eq[(et->len / sizeof(et->eq[0])) - 1].installed_cpu )
         {
diff --git a/xen/arch/x86/cpu/microcode/intel.c 
b/xen/arch/x86/cpu/microcode/intel.c
index 
6f6957058684d7275d62e525e88ff678db9eb6d2..7a383adbdf1b5cb58f2e4c89e3a1c11ecc053993
 100644
--- a/xen/arch/x86/cpu/microcode/intel.c
+++ b/xen/arch/x86/cpu/microcode/intel.c
@@ -158,8 +158,9 @@ static int microcode_sanity_check(const struct 
microcode_patch *patch)
      * Total size must be a multiple of 1024 bytes.  Data size and the header
      * must fit within it.
      */
-    if ( (total_size & 1023) ||
-         data_size > (total_size - MC_HEADER_SIZE) )
+    if ( (total_size & 1023) || (total_size < MC_HEADER_SIZE) ||
+         data_size > (total_size - MC_HEADER_SIZE) ||
+         (data_size % 4) != 0 )
     {
         printk(XENLOG_WARNING "microcode: Bad size\n");
         return -EINVAL;

base-commit: 035baa203b978b219828d0d3c16057beb344f35c
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab