Re: [PATCH v4 06/13] ACPI: extlog: Validate PCIe error section length before payload access

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Structure layout mismatch when copying raw hardware AER capabilities into `struct aer_capability_regs`, corrupting TLP prefix logs and misaligning fields.
--

--- Patch [6]: [PATCH v4 06/13] ACPI: extlog: Validate PCIe error section length before payload access ---
commit 0c68ab7e511cca4ed3e0656d8522141bd2eb2d1b
Author: Dave Jiang <dave.jiang@intel.com>

ACPI: extlog: Validate PCIe error section length before payload access

extlog_print_pcie() reads fields and copies the aer_info buffer without
checking that the error data length is big enough for a struct cper_sec_pcie.
This commit adds a check to reject sections too small to hold the record
before touching any field.

Closes: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/

> diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
> index 6d5532ec09208..3aec73187b519 100644
> --- a/drivers/acpi/acpi_extlog.c
> +++ b/drivers/acpi/acpi_extlog.c
[ ... ]
> @@ -144,6 +144,12 @@ static void extlog_print_pcie(struct cper_sec_pcie *pcie_err,
>  	int aer_severity;
>  	int domain;
>  
> +	if (len < sizeof(*pcie_err)) {
> +		pr_warn_ratelimited(FW_WARN
> +				    "PCIe error section too small (%u)\n", len);
> +		return;
> +	}
> +
>  	if (!(pcie_err->validation_bits & CPER_PCIE_VALID_DEVICE_ID &&
>  	      pcie_err->validation_bits & CPER_PCIE_VALID_AER_INFO))
>  		return;

[Severity: Medium]
This is a pre-existing issue, but does copying raw hardware AER capabilities
into struct aer_capability_regs corrupt TLP prefix logs and misalign fields?

Looking at extlog_print_pcie() right below this hunk:

drivers/acpi/acpi_extlog.c:extlog_print_pcie() {
    ...
	aer_severity = cper_severity_to_aer(severity);

	memcpy(&aer_regs, pcie_err->aer_info, sizeof(pcie_err->aer_info));
    ...
}

The memcpy blindly assumes struct aer_capability_regs matches the hardware
register layout, but the struct's header_log field is now much larger. This
causes subsequent hardware fields like root_command (offset 44) to overwrite
aer_regs.header_log.prefix.

Because struct aer_capability_regs uses a 60-byte struct pcie_tlp_log for its
header_log instead of the 16 bytes defined by the hardware specification, all
fields after header_log are misaligned. This occurs whenever a valid PCIe AER
CPER record is processed.

The GHES handler in drivers/acpi/apei/ghes.c:ghes_handle_aer() shares the
identical layout mismatch vulnerability:

drivers/acpi/apei/ghes.c:ghes_handle_aer() {
    ...
		memcpy(aer_info, pcie_err->aer_info, sizeof(pcie_err->aer_info));
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824174936.939059-1-dave.jiang@intel.com?part=6