diff options
| author | Martin Roth <martinroth@google.com> | 2016-11-18 08:56:10 -0700 |
|---|---|---|
| committer | Nico Huber <nico.h@gmx.de> | 2016-11-24 00:11:12 +0100 |
| commit | c8c5ae101aed919959187a0ad33cfbff263ff6a7 (patch) | |
| tree | 14af46b9d25c0eb5af7d63a658ec5714593ff500 /src/northbridge | |
| parent | ff94e003626ff0a496d12c703155c63ee3bbd22d (diff) | |
| download | coreboot-c8c5ae101aed919959187a0ad33cfbff263ff6a7.tar.gz coreboot-c8c5ae101aed919959187a0ad33cfbff263ff6a7.tar.bz2 coreboot-c8c5ae101aed919959187a0ad33cfbff263ff6a7.zip | |
nb/intel/i82810: Make sure DIMM size isn't negative
If smbus_read_byte returned an error when reading the DIMM size,
this value would be used as an offset into an array.
Check for the error, and set the DIMM size to 0 if there's
a problem.
Addresses coverity issue 1229658 - Negative array index read
Signed-off-by: Martin Roth <martinroth@google.com>
Change-Id: I6461a0fae819dd9261adbb411c4bba07520d076d
Reviewed-on: https://review.coreboot.org/17485
Tested-by: build bot (Jenkins)
Reviewed-by: Nico Huber <nico.h@gmx.de>
Diffstat (limited to 'src/northbridge')
| -rw-r--r-- | src/northbridge/intel/i82810/raminit.c | 34 |
1 files changed, 20 insertions, 14 deletions
diff --git a/src/northbridge/intel/i82810/raminit.c b/src/northbridge/intel/i82810/raminit.c index 83ef883342d0..edde13b6f218 100644 --- a/src/northbridge/intel/i82810/raminit.c +++ b/src/northbridge/intel/i82810/raminit.c @@ -240,22 +240,28 @@ static void spd_set_dram_size(void) printk (BIOS_ERR, "Attempting to treat as 128MB DIMM\n"); dimm_size = 32; + } else if (dimm_size < 0) { + /* On smbus error, set DIMM size to 0 */ + printk(BIOS_ERR, "Error reading DIMM size\n"); + dimm_size = 0; } - /* This array is provided in raminit.h, because it got - * extremely messy. The above way is cleaner, but - * doesn't support any asymmetrical/odd configurations. - */ - dimm_size = translate_spd_to_i82810[dimm_size]; - - printk(BIOS_DEBUG, "After translation, dimm_size is %d\n", dimm_size); - - /* If the DIMM is dual-sided, the DRP value is +2 */ - /* TODO: Figure out asymmetrical configurations. */ - if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) == - 0xff) { - printk(BIOS_DEBUG, "DIMM is dual-sided\n"); - dimm_size += 2; + if (dimm_size > 0) { + /* This array is provided in raminit.h, because it got + * extremely messy. The above way is cleaner, but + * doesn't support any asymmetrical/odd configurations. + */ + dimm_size = translate_spd_to_i82810[dimm_size]; + + printk(BIOS_DEBUG, "After translation, dimm_size is %d\n", + dimm_size); + + /* If the DIMM is dual-sided, the DRP value is +2 */ + /* TODO: Figure out asymmetrical configurations. */ + if ((smbus_read_byte(DIMM0 + i, 127) | 0xf) == 0xff) { + printk(BIOS_DEBUG, "DIMM is dual-sided\n"); + dimm_size += 2; + } } } else { printk(BIOS_DEBUG, "No DIMM found in slot %d\n", i); |