[PATCH v2 2/4] cxl/events: Validate the record count reported by the device

[Anisa Su <anisa.su887@gmail.com>]

cxl_mem_get_records_log() takes the record count straight out of the Get
Event Records payload and uses it to read from payload->records[].
An oversized count reads past that buffer. Both
__cxl_event_trace_record() and cxl_clear_event_record() use the record
count to iterate oer payload->records[].

Bound the count by mbox_cmd.size_out which is already sanitized by
 __cxl_pci_mbox_send_cmd(). Report a bad record count as an error rather than a
drained log, so a device repeating the bad count does not keep the event
thread re-reading it.

Fixes: 6ebe28f9ec72 ("cxl/mem: Read, trace, and clear events on driver load")
Signed-off-by: Anisa Su <anisa.su@samsung.com>
---
 drivers/cxl/core/mbox.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 2b71a8e1f35f..02b8c33a74b6 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -1110,6 +1110,14 @@ static int cxl_mem_get_records_log(struct cxl_memdev_state *mds,
 		nr_rec = le16_to_cpu(payload->record_count);
 		if (!nr_rec)
 			break;
+
+		if (struct_size(payload, records, nr_rec) > mbox_cmd.size_out) {
+			dev_err_ratelimited(dev,
+				"Event log '%d': record count %u mismatch in %zu byte payload",
+				type, nr_rec, mbox_cmd.size_out);
+			rc = -EIO;
+			break;
+		}
 		*got_records = true;
 
 		for (i = 0; i < nr_rec; i++)
-- 
2.43.0