From: Jonathan Cameron <jonathan.cameron@huawei.com>
To: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>,
Ard Biesheuvel <ardb@kernel.org>, <acpica-devel@lists.linux.dev>,
<linux-acpi@vger.kernel.org>, <linux-edac@vger.kernel.org>,
<linux-efi@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v5 4/4] efi/cper: don't dump the entire memory region
Date: Wed, 7 Jan 2026 17:53:06 +0000 [thread overview]
Message-ID: <20260107175306.00005d5c@huawei.com> (raw)
In-Reply-To: <f47447094cfa388042ed3563acaeb06c98ee5248.1767804050.git.mchehab+huawei@kernel.org>
On Wed, 7 Jan 2026 17:41:52 +0100
Mauro Carvalho Chehab <mchehab+huawei@kernel.org> wrote:
> The current logic at cper_print_fw_err() doesn't check if the
> error record length is big enough to handle offset. On a bad firmware,
> if the ofset is above the actual record, length -= offset will
> underflow, making it dump the entire memory.
>
> The end result can be:
>
> - the logic taking a lot of time dumping large regions of memory;
> - data disclosure due to the memory dumps;
> - an OOPS, if it tries to dump an unmapped memory region.
>
> Fix it by checking if the section length is too small before doing
> a hex dump.
>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
prev parent reply other threads:[~2026-01-07 17:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-07 16:41 [PATCH v5 0/4] apei/ghes: don't OOPS with bad ARM error CPER records Mauro Carvalho Chehab
2026-01-07 16:41 ` [PATCH v5 1/4] apei/ghes: ARM processor Error: don't go past allocated memory Mauro Carvalho Chehab
2026-01-07 16:41 ` [PATCH v5 2/4] efi/cper: don't go past the ARM processor CPER record buffer Mauro Carvalho Chehab
2026-01-07 16:41 ` [PATCH v5 3/4] apei/ghes: ensure that won't go past CPER allocated record Mauro Carvalho Chehab
2026-01-07 17:07 ` Jonathan Cameron
2026-01-07 16:41 ` [PATCH v5 4/4] efi/cper: don't dump the entire memory region Mauro Carvalho Chehab
2026-01-07 17:53 ` Jonathan Cameron [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260107175306.00005d5c@huawei.com \
--to=jonathan.cameron@huawei.com \
--cc=acpica-devel@lists.linux.dev \
--cc=ardb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-edac@vger.kernel.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=rafael@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.