From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5ECF037F307; Mon, 24 Aug 2026 17:49:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787593784; cv=none; b=cbg/kzrIYD4Gjzg9r0N1iywkQOiLLTGoqW5YcoKn6quRtn1pWXhz3xFVp5OFdY+42ugUg2lIlXuLFasUOnQaJT65ll0h9ay2StC/7jEPc4DdPE98azjvtM86HpCcyT+e0NPAiuhR0k8L7X/nriWZ/QnObvY4XY0uMea3k1zs6hc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787593784; c=relaxed/simple; bh=XjsU9RwRTSejOskqvdiGmPkyTuyFyb+VHu5njnNOqUI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jyw0fPD2al38G1nzljIJ0bSuBGhtWo79+jiMSEKynj41tKf3z6pveIBBhSEWJg7sdpFgvOQJZiM1iZU1F+df71/yrBswvj1HktFQC6mlPl9qTozRqV5OMMyJ4D1TuuKGKE67f2t/SMFCXM4Js1d3EepnjsOwjptD9zVYKFRwrpQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF95E1F000E9; Mon, 24 Aug 2026 17:49:42 +0000 (UTC) From: Dave Jiang To: linux-acpi@vger.kernel.org, linux-cxl@vger.kernel.org Cc: rafael@kernel.org, tony.luck@intel.com, bp@alien8.de, guohanjun@huawei.com, mchehab@kernel.org, xueshuai@linux.alibaba.com, terry.bowman@amd.com, benjamin.cheatham@amd.com, alison.schofield@intel.com, sashiko-bot@kernel.org Subject: [PATCH v4 03/13] ACPI: extlog: Validate elog record length before walking sections Date: Mon, 24 Aug 2026 10:49:26 -0700 Message-ID: <20260824174936.939059-4-dave.jiang@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260824174936.939059-1-dave.jiang@intel.com> References: <20260824174936.939059-1-dave.jiang@intel.com> Precedence: bulk X-Mailing-List: linux-cxl@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit extlog_print() copies a fixed ELOG_ENTRY_LEN (4096) bytes from the elog record into elog_buf, then walks the sections using the firmware-controlled data_length. Nothing keeps data_length inside the buffer, so a malformed record walks the section pointer past elog_buf and reads adjacent memory. Unlike the GHES paths, extlog never calls cper_estatus_check(). Reject a record longer than ELOG_ENTRY_LEN and run cper_estatus_check() before walking the sections. The length test alone is not enough: a wrapped length reads back short and passes it, which cper_estatus_check() catches via the header check added earlier. Drop a malformed record with NOTIFY_DONE and without MCE_HANDLED_EXTLOG, since extlog did not consume it. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=6 Fixes: f6ec01da40e4 ("ACPI: extlog: Handle multiple records") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dave Jiang --- drivers/acpi/acpi_extlog.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c index 7ad3b36013cc..9ad0052aa20c 100644 --- a/drivers/acpi/acpi_extlog.c +++ b/drivers/acpi/acpi_extlog.c @@ -208,6 +208,10 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, tmp = (struct acpi_hest_generic_status *)elog_buf; + /* Keep the firmware-controlled data_length inside elog_buf. */ + if (cper_estatus_len(tmp) > ELOG_ENTRY_LEN || cper_estatus_check(tmp)) + return NOTIFY_DONE; + if (!ras_userspace_consumers()) { print_extlog_rcd(NULL, tmp, cpu); goto out; -- 2.54.0