[PATCH v2 7/7] ACPI: APEI: GHES: Validate memory error section length before payload access

[Dave Jiang <dave.jiang@intel.com>]

ghes_handle_memory_failure() dereferences the CPER section payload
(mem_err->validation_bits, and mem_err->physical_addr) without first
checking that gdata->error_data_length is large enough to hold a
struct cper_sec_mem_err.

Fixes: ca104edc1784 ("ACPI, APEI, GHES: Cleanup ghes memory error handling")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
v2:
- new from issue raised by sashiko
---
 drivers/acpi/apei/ghes.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index b36f6d268c9f..e8b2980bd5fe 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -535,6 +535,9 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,
 	int sec_sev = ghes_severity(gdata->error_severity);
 	struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata);
 
+	if (gdata->error_data_length < sizeof(*mem_err))
+		return false;
+
 	if (!(mem_err->validation_bits & CPER_MEM_VALID_PA))
 		return false;
 
-- 
2.55.0