summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMartin Roth <martinroth@google.com>2016-11-18 08:56:10 -0700
committerNico Huber <nico.h@gmx.de>2016-11-24 00:11:12 +0100
commitc8c5ae101aed919959187a0ad33cfbff263ff6a7 (patch)
tree14af46b9d25c0eb5af7d63a658ec5714593ff500
parentff94e003626ff0a496d12c703155c63ee3bbd22d (diff)
downloadcoreboot-c8c5ae101aed919959187a0ad33cfbff263ff6a7.tar.xz
nb/intel/i82810: Make sure DIMM size isn't negative
If smbus_read_byte returned an error when reading the DIMM size, this value would be used as an offset into an array. Check for the error, and set the DIMM size to 0 if there's a problem. Addresses coverity issue 1229658 - Negative array index read Signed-off-by: Martin Roth <martinroth@google.com> Change-Id: I6461a0fae819dd9261adbb411c4bba07520d076d Reviewed-on: https://review.coreboot.org/17485 Tested-by: build bot (Jenkins) Reviewed-by: Nico Huber <nico.h@gmx.de>
-rw-r--r--src/northbridge/intel/i82810/raminit.c34
1 files changed, 20 insertions, 14 deletions
diff --git a/src/northbridge/intel/i82810/raminit.c b/src/northbridge/intel/i82810/raminit.c
index 83ef883342..edde13b6f2 100644
--- a/src/northbridge/intel/i82810/raminit.c
+++ b/src/northbridge/intel/i82810/raminit.c
@@ -240,22 +240,28 @@ static void spd_set_dram_size(void)
printk
(BIOS_ERR, "Attempting to treat as 128MB DIMM\n");
dimm_size = 32;
+ } else if (dimm_size < 0) {
+ /* On smbus error, set DIMM size to 0 */
+ printk(BIOS_ERR, "Error reading DIMM size\n");
+ dimm_size = 0;
}
- /* This array is provided in raminit.h, because it got
- * extremely messy. The above way is cleaner, but
- * doesn't support any asymmetrical/odd configurations.
- */
- dimm_size = translate_spd_to_i82810[dimm_size];
-
- printk(BIOS_DEBUG, "After translation, dimm_size is %d\n", dimm_size);
-
- /* If the DIMM is dual-sided, the DRP value is +2 */
- /* TODO: Figure out asymmetrical configurations. */
- if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) ==
- 0xff) {
- printk(BIOS_DEBUG, "DIMM is dual-sided\n");
- dimm_size += 2;
+ if (dimm_size > 0) {
+ /* This array is provided in raminit.h, because it got
+ * extremely messy. The above way is cleaner, but
+ * doesn't support any asymmetrical/odd configurations.
+ */
+ dimm_size = translate_spd_to_i82810[dimm_size];
+
+ printk(BIOS_DEBUG, "After translation, dimm_size is %d\n",
+ dimm_size);
+
+ /* If the DIMM is dual-sided, the DRP value is +2 */
+ /* TODO: Figure out asymmetrical configurations. */
+ if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) == 0xff) {
+ printk(BIOS_DEBUG, "DIMM is dual-sided\n");
+ dimm_size += 2;
+ }
}
} else {
printk(BIOS_DEBUG, "No DIMM found in slot %d\n", i);