From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4750E509F09; Fri, 4 Sep 2026 17:23:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788542629; cv=none; b=LoMYkq/MuFLDMTuwnjaVAdgzK+nogM+5RuL9v+F1XZet9mQhXNSKJpx869jt0wR0/mT1B97fBI8694rmbk+GLrgL/yN4SyvpL3MnKjGnI/RJ2jp1P0HjH47QBujMNl4hqcWzqjpL14oC0HjFKY0dPO9OytBA1VyCsAjdOSTaTKA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788542629; c=relaxed/simple; bh=95ekWHMfikI4e0WgmCrtKLqvBiV0mk7swkckD/HKVLM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QWIazwEGfzHQgXyPedVDwbrcZ6md8AJ8rIt+j8M227Bdf0e1cL44tQ8szWIZ9i+F+lTwdk7TIAxkdxSPzT5BEDEqWzkS3+SgLwt2pB2uZ2+L9FvXNIVv3bv7nqfOMqp+UqUdR6rlbaFcTofYHsvEzQBhO+dFb43z+RgOKg6qSyw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1BF961F00A3E; Fri, 4 Sep 2026 17:23:44 +0000 (UTC) From: Dave Jiang To: linux-acpi@vger.kernel.org, linux-cxl@vger.kernel.org Cc: rafael@kernel.org, tony.luck@intel.com, bp@alien8.de, guohanjun@huawei.com, mchehab@kernel.org, xueshuai@linux.alibaba.com, terry.bowman@amd.com, benjamin.cheatham@amd.com, alison.schofield@intel.com, sashiko-bot@kernel.org Subject: [PATCH v6 03/13] ACPI: extlog: Validate elog record length before walking sections Date: Fri, 4 Sep 2026 10:23:27 -0700 Message-ID: <20260904172337.1409775-4-dave.jiang@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260904172337.1409775-1-dave.jiang@intel.com> References: <20260904172337.1409775-1-dave.jiang@intel.com> Precedence: bulk X-Mailing-List: linux-cxl@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit extlog_print() copies a fixed ELOG_ENTRY_LEN (4096) bytes from the elog record into elog_buf, then walks the sections using the firmware-controlled data_length. Nothing keeps data_length inside the buffer, so a malformed record walks the section pointer past elog_buf and reads adjacent memory. Unlike the GHES paths, extlog never calls cper_estatus_check(). Reject a record longer than ELOG_ENTRY_LEN and run cper_estatus_check() before walking the sections. The length test alone is not enough: a wrapped length reads back short and passes it, which cper_estatus_check() catches via the header check added earlier. Drop a malformed record with NOTIFY_DONE and without MCE_HANDLED_EXTLOG, since extlog did not consume it. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=6 Fixes: f6ec01da40e4 ("ACPI: extlog: Handle multiple records") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Hanjun Guo Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dave Jiang --- drivers/acpi/acpi_extlog.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c index 7ad3b36013cc..046e92ee195f 100644 --- a/drivers/acpi/acpi_extlog.c +++ b/drivers/acpi/acpi_extlog.c @@ -208,6 +208,15 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, tmp = (struct acpi_hest_generic_status *)elog_buf; + /* + * Bound the length before cper_estatus_check() walks the sections: it + * iterates over data_length, which is not yet known to fit elog_buf. + * cper_estatus_check_header() then rejects a length that wrapped, which + * the bound cannot see. + */ + if (cper_estatus_len(tmp) > ELOG_ENTRY_LEN || cper_estatus_check(tmp)) + return NOTIFY_DONE; + if (!ras_userspace_consumers()) { print_extlog_rcd(NULL, tmp, cpu); goto out; -- 2.54.0