[coreboot-gerrit] Patch set updated for coreboot: nb/intel/i82810: Make sure DIMM size isn't negative

[Martin Roth (martinroth@google.com)]

Martin Roth (martinroth at google.com) just uploaded a new patch set to gerrit, which you can find at https://review.coreboot.org/17485

-gerrit

commit 5f08b75cdd271f77a057fd8db8b628cd568da484
Author: Martin Roth <martinroth at google.com>
Date:   Fri Nov 18 08:56:10 2016 -0700

    nb/intel/i82810: Make sure DIMM size isn't negative
    
    If smbus_read_byte returned an error when reading the DIMM size,
    this value would be used as an offset into an array.
    
    Check for the error, and set the DIMM size to 0 if there's
    a problem.
    
    Addresses coverity issue 1229658 - Negative array index read
    
    Signed-off-by: Martin Roth <martinroth at google.com>
    Change-Id: I6461a0fae819dd9261adbb411c4bba07520d076d
---
 src/northbridge/intel/i82810/raminit.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/src/northbridge/intel/i82810/raminit.c b/src/northbridge/intel/i82810/raminit.c
index 83ef883..edde13b 100644
--- a/src/northbridge/intel/i82810/raminit.c
+++ b/src/northbridge/intel/i82810/raminit.c
@@ -240,22 +240,28 @@ static void spd_set_dram_size(void)
 				printk
 				    (BIOS_ERR, "Attempting to treat as 128MB DIMM\n");
 				dimm_size = 32;
+			} else if (dimm_size < 0) {
+				/* On smbus error, set DIMM size to 0 */
+				printk(BIOS_ERR, "Error reading DIMM size\n");
+				dimm_size = 0;
 			}
 
-			/* This array is provided in raminit.h, because it got
-			 * extremely messy. The above way is cleaner, but
-			 * doesn't support any asymmetrical/odd configurations.
-			 */
-			dimm_size = translate_spd_to_i82810[dimm_size];
-
-			printk(BIOS_DEBUG, "After translation, dimm_size is %d\n", dimm_size);
-
-			/* If the DIMM is dual-sided, the DRP value is +2 */
-			/* TODO: Figure out asymmetrical configurations. */
-			if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) ==
-			    0xff) {
-				printk(BIOS_DEBUG, "DIMM is dual-sided\n");
-				dimm_size += 2;
+			if (dimm_size > 0) {
+				/* This array is provided in raminit.h, because it got
+				 * extremely messy. The above way is cleaner, but
+				 * doesn't support any asymmetrical/odd configurations.
+				 */
+				dimm_size = translate_spd_to_i82810[dimm_size];
+
+				printk(BIOS_DEBUG, "After translation, dimm_size is %d\n",
+					dimm_size);
+
+				/* If the DIMM is dual-sided, the DRP value is +2 */
+				/* TODO: Figure out asymmetrical configurations. */
+				if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) == 0xff) {
+					printk(BIOS_DEBUG, "DIMM is dual-sided\n");
+					dimm_size += 2;
+				}
 			}
 		} else {
 			printk(BIOS_DEBUG, "No DIMM found in slot %d\n", i);