Re: [PATCH v7 06/10] ACPI: APEI: GHES: move CXL CPER helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe out-of-bounds dereference of `rec->hdr.length` in error reporting when the CXL CPER payload is smaller than expected.
--

--- Patch [6]: [PATCH v7 06/10] ACPI: APEI: GHES: move CXL CPER helpers ---
commit ee2f071640d051dd6e9cf685ba55c5b9e8dbf870
Author: Ahmed Tiba <ahmed.tiba@arm.com>

ACPI: APEI: GHES: move CXL CPER helpers

This patch moves the CXL CPER handling code out of ghes.c and into
ghes_cper.c to allow for code reuse. It also adds new CXL CPER section
length checks and uses spinlock_irqsave() in the CXL register/unregister
paths for locking consistency.

> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index 07e4001ea8d77..2a83d326e692b 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c

[ ... ]

> @@ -549,6 +417,42 @@ static void ghes_log_hwerr(int sev, guid_t *sec_type)
>  	hwerr_log_error_type(HWERR_RECOV_OTHERS);
>  }
>  
> +static bool ghes_cxl_event_len_valid(struct acpi_hest_generic_data *gdata,
> +				     struct cxl_cper_event_rec *rec)
> +{
> +	if (gdata->error_data_length < sizeof(*rec) ||
> +	    rec->hdr.length <= sizeof(rec->hdr) ||
> +	    rec->hdr.length > gdata->error_data_length ||
> +	    rec->hdr.length > sizeof(*rec)) {
> +		pr_err(FW_WARN "CXL CPER Invalid section length (%u)\n",
> +		       rec->hdr.length);

[Severity: High]
This isn't a bug introduced by this patch, but if the first condition
(gdata->error_data_length < sizeof(*rec)) is true, won't evaluating
rec->hdr.length in this error message cause an out-of-bounds memory read?

If the firmware provides an empty or severely truncated CXL CPER payload,
reading past the end of the estatus buffer could trigger a KASAN splat or a
kernel panic.

> +		return false;
> +	}
> +
> +	return true;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-topics-ahmtib01-ras_ffh_arm_internal_review-v7-0-8b3a85216cef@arm.com?part=6