Re: [PATCH v3 08/10] ACPI: APEI: GHES: Validate memory error section length before payload access

[Shuai Xue <xueshuai@linux.alibaba.com>]

On 7/18/26 12:16 AM, Dave Jiang wrote:
> sashiko-bot flagged that the memory error length check was placed too
> late, leaving the other payload consumers unprotected.
> 
> ghes_do_proc() hands the CPER_SEC_PLATFORM_MEM payload to the report
> chain, arch_apei_report_mem_error() and ghes_handle_memory_failure()
> without checking gdata->error_data_length. These read validation_bits
> and physical_addr (offsets 0 and 16), so a shorter section reads past the
> record.
> 
> Validate error_data_length once in ghes_do_proc(), before any consumer
> runs, so every consumer is covered. Bound against struct
> cper_sec_mem_err_old (the UEFI 2.1/2.2 layout) rather than the full
> struct: the section length is authoritative, older firmware legitimately
> emits the shorter record, and the trailing fields, though packed
> unconditionally by cper_mem_err_pack(), are only acted on under
> validation bits that a short record leaves clear. This matches the lower
> bound already used in drivers/firmware/efi/cper.c.
> 
> A malformed sub-record no longer reaches ghes_handle_memory_failure().
> 
> Reported-by: sashiko-bot@kernel.org
> Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=7
> Fixes: ca104edc1784 ("ACPI, APEI, GHES: Cleanup ghes memory error handling")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
> v3:
> - Move the length check into ghes_do_proc() so the report chain and arch
>    reporter are covered too, and bound against the older UEFI 2.1/2.2
>    layout instead of the full struct (sashiko).
> ---
>   drivers/acpi/apei/ghes.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index b8dbd99da47e..1d2966a437bd 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c
> @@ -940,6 +940,17 @@ static void ghes_do_proc(struct ghes *ghes,
>   		if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
>   			struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata);
>   
> +			/*
> +			 * Several consumers below dereference the record, so
> +			 * check the length once here. Bound against the shorter
> +			 * UEFI 2.1/2.2 layout that older firmware still emits;
> +			 * the extra fields are only used under validation bits
> +			 * such records leave clear.
> +			 */
> +			if (gdata->error_data_length <
> +			    sizeof(struct cper_sec_mem_err_old))
> +				continue;
> +
>   			atomic_notifier_call_chain(&ghes_report_chain, sev, mem_err);
>   
>   			arch_apei_report_mem_error(sev, mem_err);

Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>

Thanks.
Shuai