Re: [PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

On 8/8/26 16:02, [email protected] wrote:
> From: jean delu <[email protected]>
> Date: Sat, 8 Aug 2026 16:00:00 +0200
> Subject: [PATCH] parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer
> 
> eisa_enumerator() trusts the contents of the EISA EEPROM.  The number
> of slots is read from the EEPROM header and used to access the slot
> records at HPEE_SLOT_INFO(i) = 20 + 48*i within the fixed-size
> eeprom_buf (HPEE_MAX_LENGTH, 8192 bytes) without any bound check.  As
> struct eeprom_eisa_slot_info is 48 bytes, only 170 records fit into the
> buffer, but num_slots is a u8 and may be up to 255, so a corrupted
> EEPROM makes the code read up to about 4 kB past the end of the buffer
> (e.g. record 254 is accessed at offset 20 + 48*254 = 12212).
> 
> parse_slot_config() has the same kind of problem: it clamps
> config_data_length against HPEE_MAX_LENGTH but does not take
> config_data_offset into account, so the parser can walk past the end of
> the buffer even when the offset itself is valid.
> 
> Clamp the number of slots so that all slot records fit into the buffer,
> and hand the number of bytes actually available to parse_slot_config()
> and bound the parse by it.
> 
> Signed-off-by: jean delu <[email protected]>
> ---
> drivers/parisc/eisa_enumerator.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/parisc/eisa_enumerator.c b/drivers/parisc/eisa_enumerator.c
> index e0a57086a..f6014258e 100644
> --- a/drivers/parisc/eisa_enumerator.c
> +++ b/drivers/parisc/eisa_enumerator.c
> @@ -311,6 +311,7 @@ static int configure_function(const unsigned char *buf, int *more)
>   
> static int parse_slot_config(int slot,
>      const unsigned char *buf,
> +			    unsigned int buflen,

Can you please resend this patch?
Your indenting is compeletely wrong.
It might be your mail program, your mail provider or your editor who
messes up the whitespaces.

Helge