From: Jonathan Cameron <jic23@kernel.org>
To: Dave Jiang <dave.jiang@intel.com>
Cc: linux-acpi@vger.kernel.org, linux-cxl@vger.kernel.org,
rafael@kernel.org, tony.luck@intel.com, bp@alien8.de,
guohanjun@huawei.com, mchehab@kernel.org,
xueshuai@linux.alibaba.com, terry.bowman@amd.com,
benjamin.cheatham@amd.com, alison.schofield@intel.com,
sashiko-bot@kernel.org
Subject: Re: [PATCH v4 08/13] ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length
Date: Tue, 25 Aug 2026 00:13:09 +0100 [thread overview]
Message-ID: <20260825001309.23468edd@jic23-huawei> (raw)
In-Reply-To: <20260824174936.939059-9-dave.jiang@intel.com>
On Mon, 24 Aug 2026 10:49:31 -0700
Dave Jiang <dave.jiang@intel.com> wrote:
> cxl_cper_post_event() copies a fixed sizeof(struct cxl_cper_event_rec)
> out of the firmware CPER section without checking how long the section
> actually is, so a short one reads past the record.
>
> Pass gdata->error_data_length in and reject a section too small to hold
> the record before the copy.
>
> Reported-by: sashiko-bot@kernel.org
> Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6
> Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events")
> Reviewed-by: Alison Schofield <alison.schofield@intel.com>
> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
next prev parent reply other threads:[~2026-08-24 23:13 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-24 17:49 [PATCH v4 00/13] ACPI: APEI: GHES: Collection of fixes for issues reported by sashiko Dave Jiang
2026-08-24 17:49 ` [PATCH v4 01/13] efi/cper: Reject CPER records with an out-of-range error_data_length Dave Jiang
2026-08-24 18:10 ` sashiko-bot
2026-08-24 21:57 ` Jonathan Cameron
2026-08-25 16:31 ` Dave Jiang
2026-08-24 17:49 ` [PATCH v4 02/13] efi/cper: Reject an error status block length that wraps a u32 Dave Jiang
2026-08-24 18:03 ` sashiko-bot
2026-08-24 22:22 ` Jonathan Cameron
2026-08-24 17:49 ` [PATCH v4 03/13] ACPI: extlog: Validate elog record length before walking sections Dave Jiang
2026-08-24 18:07 ` sashiko-bot
2026-08-24 22:28 ` Jonathan Cameron
2026-08-25 17:15 ` Dave Jiang
2026-08-24 17:49 ` [PATCH v4 04/13] ACPI: extlog: Defer CXL protocol error handling to avoid lock inversion Dave Jiang
2026-08-24 18:03 ` sashiko-bot
2026-08-24 22:29 ` Jonathan Cameron
2026-08-24 17:49 ` [PATCH v4 05/13] ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer Dave Jiang
2026-08-24 18:13 ` sashiko-bot
2026-08-24 23:05 ` Jonathan Cameron
2026-08-25 17:38 ` Dave Jiang
2026-08-24 17:49 ` [PATCH v4 06/13] ACPI: extlog: Validate PCIe error section length before payload access Dave Jiang
2026-08-24 18:07 ` sashiko-bot
2026-08-24 23:08 ` Jonathan Cameron
2026-08-24 17:49 ` [PATCH v4 07/13] ACPI: extlog: Fix CONFIG_ACPI_APEI_PCIEAER guard typo Dave Jiang
2026-08-24 18:15 ` sashiko-bot
2026-08-24 23:11 ` Jonathan Cameron
2026-08-24 17:49 ` [PATCH v4 08/13] ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length Dave Jiang
2026-08-24 23:13 ` Jonathan Cameron [this message]
2026-08-24 17:49 ` [PATCH v4 09/13] ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy Dave Jiang
2026-08-24 18:10 ` sashiko-bot
2026-08-24 23:14 ` Jonathan Cameron
2026-08-24 17:49 ` [PATCH v4 10/13] efi/cper: Read only validated fields in cper_mem_err_pack() Dave Jiang
2026-08-24 18:08 ` sashiko-bot
2026-08-24 17:49 ` [PATCH v4 11/13] ACPI: APEI: GHES: Validate memory error section length before payload access Dave Jiang
2026-08-24 18:17 ` sashiko-bot
2026-08-24 17:49 ` [PATCH v4 12/13] ACPI: APEI: GHES: Bound AER info copy and sanitize software metadata Dave Jiang
2026-08-24 18:17 ` sashiko-bot
2026-08-24 21:32 ` Dave Jiang
2026-08-24 17:49 ` [PATCH v4 13/13] cxl/ras: Make cxl_cper_handle_prot_err() static Dave Jiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260825001309.23468edd@jic23-huawei \
--to=jic23@kernel.org \
--cc=alison.schofield@intel.com \
--cc=benjamin.cheatham@amd.com \
--cc=bp@alien8.de \
--cc=dave.jiang@intel.com \
--cc=guohanjun@huawei.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-cxl@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=rafael@kernel.org \
--cc=sashiko-bot@kernel.org \
--cc=terry.bowman@amd.com \
--cc=tony.luck@intel.com \
--cc=xueshuai@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox