Re: [PATCH v2 3/5] ACPI: NFIT: validate interleave and flush array extents

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds read in add_dcr() due to unchecked sizeof_dcr() calculation.
- [High] Out-of-bounds read in add_platform_cap() due to insufficient subtable length validation.
- [High] ACPI notify handlers leak when DIMM registration fails, leading to Use-After-Free.
- [High] Time-Of-Check to Time-Of-Use (TOCTOU) Heap Buffer Overflow in add_idt() and add_flush().
--

--- Patch [3]: [PATCH v2 3/5] ACPI: NFIT: validate interleave and flush array extents ---
commit 5f0d0836358fb697d133a3d8f0839ed8e9b8fd8d
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

ACPI: NFIT: validate interleave and flush array extents

Interleave and flush subtables carry a fixed header followed by arrays
whose element counts come from firmware. sizeof_idt() and sizeof_flush()
derive the copy size from those counts but do not require the result to
fit in the subtable's advertised length.

> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index f68edfe649528..bf4ddc56494e3 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -882,9 +882,16 @@ static bool add_bdw(struct acpi_nfit_desc *acpi_desc,
>  
>  static size_t sizeof_idt(struct acpi_nfit_interleave *idt)
>  {
> +	size_t size;
> +
>  	if (idt->header.length < sizeof(*idt))
>  		return 0;
> -	return sizeof(*idt) + sizeof(u32) * idt->line_count;
> +
> +	size = struct_size(idt, line_offset, idt->line_count);
> +	if (size > idt->header.length)
> +		return 0;
> +
> +	return size;
>  }

[Severity: High]
This is a pre-existing issue, but does fetching the size fields directly from
mapped memory here and in sizeof_flush() create a time-of-check to time-of-use
race condition?

Looking at add_idt(), the size is evaluated twice:

static bool add_idt(struct acpi_nfit_desc *acpi_desc, ...)
{
	...
	nfit_idt = devm_kzalloc(dev, sizeof(*nfit_idt) + sizeof_idt(idt),
			GFP_KERNEL);
	...
	memcpy(nfit_idt->idt, idt, sizeof_idt(idt));
	...
}

If firmware or a hypervisor alters line_count concurrently between the
allocation and the memcpy, could this lead to a heap buffer overflow?

[ ... ]

>  
>  static size_t sizeof_flush(struct acpi_nfit_flush_address *flush)
>  {
> +	size_t size;
> +
>  	if (flush->header.length < sizeof(*flush))
>  		return 0;
> -	return struct_size(flush, hint_address, flush->hint_count);
> +
> +	size = struct_size(flush, hint_address, flush->hint_count);
> +	if (size > flush->header.length)
> +		return 0;
> +
> +	return size;
>  }

[Severity: High]
This isn't a bug introduced by this patch, but while we are improving bounds
checking, could sizeof_dcr() also read out of bounds?

If a control region subtable has a short length but dcr->windows is non-zero,
sizeof_dcr() returns the full size:

static size_t sizeof_dcr(struct acpi_nfit_control_region *dcr)
{
	...
	if (dcr->windows)
		return sizeof(*dcr);
	...
}

Will this cause memcmp() to read out of bounds in add_dcr() when the derived
size is not validated against the actual subtable length?

[Severity: High]
This is a pre-existing issue, but does add_platform_cap() similarly lack length
validation?

When add_table() processes ACPI_NFIT_TYPE_CAPABILITIES, it unconditionally
dispatches the function:

	case ACPI_NFIT_TYPE_CAPABILITIES:
		if (!add_platform_cap(acpi_desc, table))
			return err;
		break;

If the table length is short (e.g., 4 bytes), could the dereferences in
add_platform_cap() cause an out-of-bounds read?

static bool add_platform_cap(struct acpi_nfit_desc *acpi_desc,
		struct acpi_nfit_capabilities *pcap)
{
	...
	mask = (1 << (pcap->highest_capability + 1)) - 1;
	acpi_desc->platform_cap = pcap->capabilities & mask;
	...
}

[Severity: High]
This isn't a bug introduced by this patch, but does acpi_nfit_register_dimms()
leak notify handlers on failure?

During dimm registration, if memory allocation fails for nvdimm, the function
returns early:

static int acpi_nfit_register_dimms(struct acpi_nfit_desc *acpi_desc)
{
	...
		nvdimm = __nvdimm_create(...);
		if (!nvdimm)
			return -ENOMEM;
	...
	return devm_add_action_or_reset(acpi_desc->dev, shutdown_dimm_notify,
			acpi_desc);
}

Since shutdown_dimm_notify is only queued for cleanup at the very end of the
function, do we leave dangling notify handlers registered if the loop aborts
early?

Could a subsequent event then trigger a use-after-free on the freed nfit_mem
structures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813150948.17239-1-pengpeng@iscas.ac.cn?part=3