From c8c5ae101aed919959187a0ad33cfbff263ff6a7 Mon Sep 17 00:00:00 2001 From: Martin Roth Date: Fri, 18 Nov 2016 08:56:10 -0700 Subject: nb/intel/i82810: Make sure DIMM size isn't negative If smbus_read_byte returned an error when reading the DIMM size, this value would be used as an offset into an array. Check for the error, and set the DIMM size to 0 if there's a problem. Addresses coverity issue 1229658 - Negative array index read Signed-off-by: Martin Roth Change-Id: I6461a0fae819dd9261adbb411c4bba07520d076d Reviewed-on: https://review.coreboot.org/17485 Tested-by: build bot (Jenkins) Reviewed-by: Nico Huber --- src/northbridge/intel/i82810/raminit.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) (limited to 'src') diff --git a/src/northbridge/intel/i82810/raminit.c b/src/northbridge/intel/i82810/raminit.c index 83ef883342..edde13b6f2 100644 --- a/src/northbridge/intel/i82810/raminit.c +++ b/src/northbridge/intel/i82810/raminit.c @@ -240,22 +240,28 @@ static void spd_set_dram_size(void) printk (BIOS_ERR, "Attempting to treat as 128MB DIMM\n"); dimm_size = 32; + } else if (dimm_size < 0) { + /* On smbus error, set DIMM size to 0 */ + printk(BIOS_ERR, "Error reading DIMM size\n"); + dimm_size = 0; } - /* This array is provided in raminit.h, because it got - * extremely messy. The above way is cleaner, but - * doesn't support any asymmetrical/odd configurations. - */ - dimm_size = translate_spd_to_i82810[dimm_size]; - - printk(BIOS_DEBUG, "After translation, dimm_size is %d\n", dimm_size); - - /* If the DIMM is dual-sided, the DRP value is +2 */ - /* TODO: Figure out asymmetrical configurations. */ - if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) == - 0xff) { - printk(BIOS_DEBUG, "DIMM is dual-sided\n"); - dimm_size += 2; + if (dimm_size > 0) { + /* This array is provided in raminit.h, because it got + * extremely messy. The above way is cleaner, but + * doesn't support any asymmetrical/odd configurations. + */ + dimm_size = translate_spd_to_i82810[dimm_size]; + + printk(BIOS_DEBUG, "After translation, dimm_size is %d\n", + dimm_size); + + /* If the DIMM is dual-sided, the DRP value is +2 */ + /* TODO: Figure out asymmetrical configurations. */ + if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) == 0xff) { + printk(BIOS_DEBUG, "DIMM is dual-sided\n"); + dimm_size += 2; + } } } else { printk(BIOS_DEBUG, "No DIMM found in slot %d\n", i); -- cgit v1.2.3