From b7a4915a2b43d47f0bbb0b2a4c30e722fa0d3191 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Fri, 4 Sep 2026 10:23:32 -0700 Subject: [PATCH] ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length cxl_cper_post_event() copies a fixed sizeof(struct cxl_cper_event_rec) out of the firmware CPER section without checking how long the section actually is, so a short one reads past the record. Pass gdata->error_data_length in and reject a section too small to hold the record before the copy. Reported-by: sashiko-bot@kernel.org Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6 Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-9-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki --- drivers/acpi/apei/ghes.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 83558bb10be1..8f66dfb8edba 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -824,10 +824,15 @@ static DEFINE_RAW_SPINLOCK(cxl_cper_work_lock); struct work_struct *cxl_cper_work; static void cxl_cper_post_event(enum cxl_event_type event_type, - struct cxl_cper_event_rec *rec) + struct cxl_cper_event_rec *rec, u32 len) { struct cxl_cper_work_data wd; + if (len < sizeof(*rec)) { + pr_err(FW_WARN "CXL CPER section too small (%u)\n", len); + return; + } + if (rec->hdr.length <= sizeof(rec->hdr) || rec->hdr.length > sizeof(*rec)) { pr_err(FW_WARN "CXL CPER Invalid section length (%u)\n", @@ -964,15 +969,18 @@ static void ghes_do_proc(struct ghes *ghes, } else if (guid_equal(sec_type, &CPER_SEC_CXL_GEN_MEDIA_GUID)) { struct cxl_cper_event_rec *rec = acpi_hest_get_payload(gdata); - cxl_cper_post_event(CXL_CPER_EVENT_GEN_MEDIA, rec); + cxl_cper_post_event(CXL_CPER_EVENT_GEN_MEDIA, rec, + gdata->error_data_length); } else if (guid_equal(sec_type, &CPER_SEC_CXL_DRAM_GUID)) { struct cxl_cper_event_rec *rec = acpi_hest_get_payload(gdata); - cxl_cper_post_event(CXL_CPER_EVENT_DRAM, rec); + cxl_cper_post_event(CXL_CPER_EVENT_DRAM, rec, + gdata->error_data_length); } else if (guid_equal(sec_type, &CPER_SEC_CXL_MEM_MODULE_GUID)) { struct cxl_cper_event_rec *rec = acpi_hest_get_payload(gdata); - cxl_cper_post_event(CXL_CPER_EVENT_MEM_MODULE, rec); + cxl_cper_post_event(CXL_CPER_EVENT_MEM_MODULE, rec, + gdata->error_data_length); } else { void *err = acpi_hest_get_payload(gdata);