* [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection
@ 2025-08-14 16:17 Tony Luck
2025-08-14 20:42 ` Zaid Alali
2025-08-18 15:58 ` Hanjun Guo
0 siblings, 2 replies; 4+ messages in thread
From: Tony Luck @ 2025-08-14 16:17 UTC (permalink / raw)
To: Rafael J. Wysocki
Cc: Borislav Petkov, Hanjun Guo, Mauro Carvalho Chehab, Shuai Xue,
Len Brown, Zaid Alali, linux-acpi, linux-kernel, patches,
Tony Luck, Lai, Yi1
On an EINJV2 capable system, users may still use the old injection
interface but einj_get_parameter_address() takes the EINJV2 path to map
the parameter structure. This results in the address the user supplied
being stored to the wrong location and the BIOS injecting based on an
uninitialized field (0x0 in the reported case).
Check the version of the request when mapping the EINJ parameter
structure in BIOS reserved memory.
Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
Reported-by: Lai, Yi1 <yi1.lai@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
---
drivers/acpi/apei/einj-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
index bf8dc92a373a..99f1b841fba9 100644
--- a/drivers/acpi/apei/einj-core.c
+++ b/drivers/acpi/apei/einj-core.c
@@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
memcpy_fromio(&v5param, p, v5param_size);
acpi5 = 1;
check_vendor_extension(pa_v5, &v5param);
- if (available_error_type & ACPI65_EINJV2_SUPP) {
+ if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
len = v5param.einjv2_struct.length;
offset = offsetof(struct einjv2_extension_struct, component_arr);
max_nr_components = (len - offset) /
--
2.50.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection
2025-08-14 16:17 [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection Tony Luck
@ 2025-08-14 20:42 ` Zaid Alali
2025-08-18 15:58 ` Hanjun Guo
1 sibling, 0 replies; 4+ messages in thread
From: Zaid Alali @ 2025-08-14 20:42 UTC (permalink / raw)
To: Tony Luck
Cc: Rafael J. Wysocki, Borislav Petkov, Hanjun Guo,
Mauro Carvalho Chehab, Shuai Xue, Len Brown, linux-acpi,
linux-kernel, patches, Lai, Yi1
On Thu, Aug 14, 2025 at 09:17:06AM -0700, Tony Luck wrote:
> On an EINJV2 capable system, users may still use the old injection
> interface but einj_get_parameter_address() takes the EINJV2 path to map
> the parameter structure. This results in the address the user supplied
> being stored to the wrong location and the BIOS injecting based on an
> uninitialized field (0x0 in the reported case).
>
> Check the version of the request when mapping the EINJ parameter
> structure in BIOS reserved memory.
>
> Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
> Reported-by: Lai, Yi1 <yi1.lai@intel.com>
> Signed-off-by: Tony Luck <tony.luck@intel.com>
Looks good to me.
Reviewed-by: Zaid Alali <zaidal@os.amperecomputing.com>
> ---
> drivers/acpi/apei/einj-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
> index bf8dc92a373a..99f1b841fba9 100644
> --- a/drivers/acpi/apei/einj-core.c
> +++ b/drivers/acpi/apei/einj-core.c
> @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
> memcpy_fromio(&v5param, p, v5param_size);
> acpi5 = 1;
> check_vendor_extension(pa_v5, &v5param);
> - if (available_error_type & ACPI65_EINJV2_SUPP) {
> + if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
> len = v5param.einjv2_struct.length;
> offset = offsetof(struct einjv2_extension_struct, component_arr);
> max_nr_components = (len - offset) /
> --
> 2.50.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection
2025-08-14 16:17 [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection Tony Luck
2025-08-14 20:42 ` Zaid Alali
@ 2025-08-18 15:58 ` Hanjun Guo
2025-08-18 16:08 ` Rafael J. Wysocki
1 sibling, 1 reply; 4+ messages in thread
From: Hanjun Guo @ 2025-08-18 15:58 UTC (permalink / raw)
To: Tony Luck, Rafael J. Wysocki
Cc: Borislav Petkov, Mauro Carvalho Chehab, Shuai Xue, Len Brown,
Zaid Alali, linux-acpi, linux-kernel, patches, Lai, Yi1
On 2025/8/15 0:17, Tony Luck wrote:
> On an EINJV2 capable system, users may still use the old injection
> interface but einj_get_parameter_address() takes the EINJV2 path to map
> the parameter structure. This results in the address the user supplied
> being stored to the wrong location and the BIOS injecting based on an
> uninitialized field (0x0 in the reported case).
>
> Check the version of the request when mapping the EINJ parameter
> structure in BIOS reserved memory.
>
> Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
> Reported-by: Lai, Yi1 <yi1.lai@intel.com>
> Signed-off-by: Tony Luck <tony.luck@intel.com>
> ---
> drivers/acpi/apei/einj-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
> index bf8dc92a373a..99f1b841fba9 100644
> --- a/drivers/acpi/apei/einj-core.c
> +++ b/drivers/acpi/apei/einj-core.c
> @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
> memcpy_fromio(&v5param, p, v5param_size);
> acpi5 = 1;
> check_vendor_extension(pa_v5, &v5param);
> - if (available_error_type & ACPI65_EINJV2_SUPP) {
> + if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
> len = v5param.einjv2_struct.length;
> offset = offsetof(struct einjv2_extension_struct, component_arr);
> max_nr_components = (len - offset) /
Reviewed-by: Hanjun Guo <gouhanjun@huawei.com>
Thanks
Hanjun
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection
2025-08-18 15:58 ` Hanjun Guo
@ 2025-08-18 16:08 ` Rafael J. Wysocki
0 siblings, 0 replies; 4+ messages in thread
From: Rafael J. Wysocki @ 2025-08-18 16:08 UTC (permalink / raw)
To: Hanjun Guo, Tony Luck
Cc: Rafael J. Wysocki, Borislav Petkov, Mauro Carvalho Chehab,
Shuai Xue, Len Brown, Zaid Alali, linux-acpi, linux-kernel,
patches, Lai, Yi1
On Mon, Aug 18, 2025 at 5:58 PM Hanjun Guo <guohanjun@huawei.com> wrote:
>
> On 2025/8/15 0:17, Tony Luck wrote:
> > On an EINJV2 capable system, users may still use the old injection
> > interface but einj_get_parameter_address() takes the EINJV2 path to map
> > the parameter structure. This results in the address the user supplied
> > being stored to the wrong location and the BIOS injecting based on an
> > uninitialized field (0x0 in the reported case).
> >
> > Check the version of the request when mapping the EINJ parameter
> > structure in BIOS reserved memory.
> >
> > Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
> > Reported-by: Lai, Yi1 <yi1.lai@intel.com>
> > Signed-off-by: Tony Luck <tony.luck@intel.com>
> > ---
> > drivers/acpi/apei/einj-core.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
> > index bf8dc92a373a..99f1b841fba9 100644
> > --- a/drivers/acpi/apei/einj-core.c
> > +++ b/drivers/acpi/apei/einj-core.c
> > @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
> > memcpy_fromio(&v5param, p, v5param_size);
> > acpi5 = 1;
> > check_vendor_extension(pa_v5, &v5param);
> > - if (available_error_type & ACPI65_EINJV2_SUPP) {
> > + if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
> > len = v5param.einjv2_struct.length;
> > offset = offsetof(struct einjv2_extension_struct, component_arr);
> > max_nr_components = (len - offset) /
>
> Reviewed-by: Hanjun Guo <gouhanjun@huawei.com>
Applied as 6.17-rc material, thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-18 16:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-14 16:17 [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection Tony Luck
2025-08-14 20:42 ` Zaid Alali
2025-08-18 15:58 ` Hanjun Guo
2025-08-18 16:08 ` Rafael J. Wysocki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).