Re: [PATCH v6] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl

[Ira Weiny <ira.weiny@intel.com>]

Suraj Sonawane wrote:
> On 11/18/24 21:56, Suraj Sonawane wrote:

[snip]

> > 
> >   drivers/acpi/nfit/core.c | 7 ++++++-
> >   1 file changed, 6 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> > index 5429ec9ef..a5d47819b 100644
> > --- a/drivers/acpi/nfit/core.c
> > +++ b/drivers/acpi/nfit/core.c
> > @@ -454,8 +454,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
> >   	if (cmd_rc)
> >   		*cmd_rc = -EINVAL;
> >   
> > -	if (cmd == ND_CMD_CALL)
> > +	if (cmd == ND_CMD_CALL) {
> > +		if (!buf || buf_len < sizeof(*call_pkg))
> > +			return -EINVAL;
> > +
> >   		call_pkg = buf;
> > +	}
> > +
> >   	func = cmd_to_func(nfit_mem, cmd, call_pkg, &family);
> >   	if (func < 0)
> >   		return func;
> 
> Hello!
> 
> I wanted to follow up on the patch I submitted. I have incorporated all 
> the suggested changes up to v6. I was wondering if you had a chance to 
> review it and if there are any comments or feedback.

It just missed the soak period for the merge.  But I'll be looking at it
for an rc pull request.

Thanks for sticking with it,
Ira

[snip]