From 3b9fae176d9ef65be7f3baeec1f4ffda3b5a1bbb Mon Sep 17 00:00:00 2001 From: "Johann C. Rode" Date: Wed, 11 Feb 2026 20:07:01 -0800 Subject: [PATCH] mb/lenovo/sklkbl/spd: Fix integer overflow This fixes an integer overflow in the calculation of the offset within the SPD binary that has caused memory detection failures on some machines (e.g. this resolves https://ticket.coreboot.org/issues/627 ). In a nutshell, spd_index (uint8_t) receives an assigned multiplication by 512 (SPD_SIZE_MAX_DDR4) which will always truncate the result. Change-Id: I048a73c18c9a3d1b20e2a4276e1714e59550eaf5 Signed-off-by: Johann C. Rode Reviewed-on: https://review.coreboot.org/c/coreboot/+/91170 Reviewed-by: Patrick Rudolph Reviewed-by: Angel Pons Tested-by: build bot (Jenkins) --- src/mainboard/lenovo/sklkbl_thinkpad/spd/spd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/mainboard/lenovo/sklkbl_thinkpad/spd/spd.c b/src/mainboard/lenovo/sklkbl_thinkpad/spd/spd.c index 6ce18e5167..eaff251cc7 100644 --- a/src/mainboard/lenovo/sklkbl_thinkpad/spd/spd.c +++ b/src/mainboard/lenovo/sklkbl_thinkpad/spd/spd.c @@ -28,8 +28,7 @@ uint8_t *mainboard_find_spd_data(uint8_t spd_index) die("Missing SPD data (spd.bin size %zu smaller than SPD size %u).", spd_file_len, SPD_SIZE_MAX_DDR4); /* Assume same memory in both channels */ - spd_index *= SPD_SIZE_MAX_DDR4; - spd_data = (uint8_t *)(spd_file + spd_index); + spd_data = (uint8_t *)(spd_file + spd_index * SPD_SIZE_MAX_DDR4); /* Make sure a valid SPD was found */ if (spd_data[0] == 0)