Re: [PATCH] ACPI: APEI: EINJ: Validate length of the Vendor Error Type Extension structure

[Zenghui Yu <yuzenghui@huawei.com>]

Hi Tony,

On 2026/11/13 8:27, Luck, Tony wrote:
> > The BIOS on my machine is obviously buggy (non-zero Vendor Extension offset
> > pointing to zeroed memory, and bit 31 is not set in the error type either)
> > and needs fixing. I'm not sure if it is necessary to add such a sanity
> > check for EINJ at all.
> 
> Production machine? Or just an internal development machine?  I.e. is this broken
> BIOS out in the wild for others to hit this bug?

The bug was hit on one of my development machines. The BIOS is pretty old.

$ cat /sys/class/dmi/id/bios_vendor 
Huawei Corp.
$ cat /sys/class/dmi/id/bios_date 
09/18/2019

I'm afraid that I can't tell whether this exact BIOS version ever shipped
on production machines.

So this patch may effectively just be a workaround for my old machine. I'll
leave the decision on whether it's worth taking to maintainers. ;-)

> >
> > +     if (v.length < sizeof(v) || v.length > PAGE_SIZE) {
> > +             pr_warn(FW_BUG "Invalid vendor error extension length %u\n",
> 
> The "FW_BUG" tag was created specifically to point blame at BIOS and thus
> encourage OEMs to fix their BIOS. So correct use of it here :-)
> 
> > +                     v.length);
> > +             acpi_os_unmap_iomem(p, sizeof(v));
> > +             return;
> > +     }
> 
> The fix looks reasonable. If this has been seen on a production system, then
> seems a good idea to apply your patch.
> 
> Reviewed-by: Tony Luck <tony.luck@intel.com>

Thanks for your review!

Zenghui