github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ACPI: APEI: GHES: Validate memory error section length before payload access

Browse Source 
ghes_do_proc() hands the CPER_SEC_PLATFORM_MEM payload to the report chain,
arch_apei_report_mem_error() and ghes_handle_memory_failure() without
checking gdata->error_data_length. All three read validation_bits and
physical_addr, at offsets 0 and 16, so a shorter section reads past the
record.

Check the length once in ghes_do_proc(), before any consumer runs. Take the
73-byte struct cper_sec_mem_err_old as the floor: older firmware
legitimately emits that UEFI 2.1/2.2 layout, and it makes validation_bits
safe to read.

The fields from "extended" on are absent from that layout, so also require
whatever length the validation bits claim. Derive it per field rather than
demanding the full 80 bytes: rank needs only 76, and the BANK_GROUP and
BANK_ADDRESS bits describe "bank" at offset 38, which every record carries.
Testing the whole mask against one size, as cper_print_mem() does, gets it
wrong both ways.

Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=7
Fixes: ca104edc17 ("ACPI, APEI, GHES: Cleanup ghes memory error handling")
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260904172337.1409775-12-dave.jiang@intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Dave Jiang 2026-09-04 10:23:35 -07:00 committed by Rafael J. Wysocki
parent 92480a2b00
commit 10338c9085
1 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
drivers/acpi/apei/ghes.c
View File

@ -929,6 +929,28 @@ static void ghes_log_hwerr(int sev, guid_t *sec_type)
hwerr_log_error_type(HWERR_RECOV_OTHERS);
}
/*
* The fields from "extended" on are absent from the 73-byte UEFI 2.1/2.2
* layout that older firmware still emits. Return the length needed for the
* fields the validation bits claim, so over-claiming is rejected without
* rejecting an honest short record.
*/
static u32 ghes_mem_err_min_len(u64 validation_bits)
{
u32 len = sizeof(struct cper_sec_mem_err_old);
if (validation_bits & (CPER_MEM_VALID_ROW_EXT | CPER_MEM_VALID_CHIP_ID))
len = offsetof(struct cper_sec_mem_err, rank);
if (validation_bits & CPER_MEM_VALID_RANK_NUMBER)
len = offsetof(struct cper_sec_mem_err, mem_array_handle);
if (validation_bits & CPER_MEM_VALID_CARD_HANDLE)
len = offsetof(struct cper_sec_mem_err, mem_dev_handle);
if (validation_bits & CPER_MEM_VALID_MODULE_HANDLE)
len = sizeof(struct cper_sec_mem_err);
return len;
}
static void ghes_do_proc(struct ghes *ghes,
const struct acpi_hest_generic_status *estatus)
{
@ -954,6 +976,25 @@ static void ghes_do_proc(struct ghes *ghes,
if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata);
/*
* Check once for all three consumers below. The 73-byte
* UEFI 2.1/2.2 layout is the floor, matching
* cper_estatus_print_section() and making
* validation_bits safe to read.
*/
if (gdata->error_data_length <
sizeof(struct cper_sec_mem_err_old))
continue;
/* Then require what the claimed fields actually need. */
if (gdata->error_data_length <
ghes_mem_err_min_len(mem_err->validation_bits)) {
pr_warn_ratelimited(FW_WARN GHES_PFX
"memory error section too small (%u) for the fields it claims\n",
gdata->error_data_length);
continue;
}
atomic_notifier_call_chain(&ghes_report_chain, sev, mem_err);
arch_apei_report_mem_error(sev, mem_err);