Re: [PATCH] ACPI/PPTT: fix off-by-one error

Rafael J. Wysocki
2025-05-07T11:59:23Z

On Wed, May 7, 2025 at 1:53 PM Heyne, Maximilian <mheyne@amazon.de> wrote:
>
> On Tue, May 06, 2025 at 03:11:20PM -0500, Jeremy Linton wrote:
> > Hi,
> >
> > On 5/6/25 8:43 AM, Sudeep Holla wrote:
> > > On Tue, May 06, 2025 at 01:13:02PM +0000, Heyne, Maximilian wrote:
> > > > Commit 7ab4f0e37a0f ("ACPI PPTT: Fix coding mistakes in a couple of
> > > > sizeof() calls") corrects the processer entry size but unmasked a longer
> > > > standing bug where the last entry in the structure can get skipped due
> > > > to an off-by-one mistake if the last entry ends exactly at the end of
> > > > the ACPI subtable.
> > > >
> > >
> > > Unless the firmware has populated an incorrect value for the header length, I
> > > don't see how this is possible. The table_end should point to the address
> > > immediately following the last byte of the table. None of the headers are only
> > > one byte long, so what am I missing that could explain this apparent
> > > off-by-one issue?.
> >
> > More likely its because the sizeof() fix was merged without proper review
> > and is wrong because the type isn't actually known on the object until the
> > header is checked.
>
> I agree that the type might not be known at this point but the condition
>
> proc_sz = sizeof(struct acpi_pptt_processor);
> while((unsigned long)entry + proc_sz <= table_end)
>
> would make sure that there could potentially be a node of type
> acpi_pptt_processor because there is at least space for it. If the entry
> can't be of that size because it would go over table_end then it can't
> be an acpi_pptt_processor.

I don't follow.

If it is an acpi_pptt_processor entry, the original condition would be
sufficient (assuming the correctness of the table header), wouldn't
it?

> Therefore, I don't think the sizeof() fix is that wrong but we just need
> to adjust the while condition.

The sizeof() fix is correct, it makes the code work as designed.

> Alternatively, we could at least make sure that we can safely access
> (without crossing table_end) the acpi_subtable_header to check the type.

Yes.

> But the current approach seems cleaner to me.

Why do you think so?