Re: [PATCH v3 10/10] ACPI: extlog: Validate elog record length before walking sections

On 7/18/26 12:16 AM, Dave Jiang wrote:
> sashiko-bot flagged a missing bounds check on data_length that allows
> an out-of-bounds read of elog_buf.
> 
> extlog_print() copies a fixed ELOG_ENTRY_LEN (4096) bytes from the elog
> record into elog_buf, then walks the sections using the
> firmware-controlled data_length. Nothing checks that data_length stays
> within the buffer, so a malformed record can walk the section pointer
> past elog_buf and read adjacent memory.
> 
> Unlike the GHES paths, extlog never calls cper_estatus_check(). Reject a
> record whose length exceeds ELOG_ENTRY_LEN and run cper_estatus_check()
> before walking the sections.
> 
> A malformed record is now dropped with NOTIFY_DONE without setting
> MCE_HANDLED_EXTLOG, reflecting that extlog did not consume it.
> 
> Reported-by: [email protected]
> Closes: https://sashiko.dev/#/patchset/[email protected]?part=6
> Fixes: f6ec01da40e4 ("ACPI: extlog: Handle multiple records")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dave Jiang <[email protected]>
> ---
> v3:
> - New patch. sashiko's review of v2 pointed out extlog walks the elog
>    sections without the cper_estatus_check() bound the GHES paths use.
> ---
>   drivers/acpi/acpi_extlog.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
> index 1fbaf134c04e..30863fd3f5b0 100644
> --- a/drivers/acpi/acpi_extlog.c
> +++ b/drivers/acpi/acpi_extlog.c
> @@ -200,6 +200,13 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
>   
>   	tmp = (struct acpi_hest_generic_status *)elog_buf;
>   
> +	/*
> +	 * data_length is firmware controlled, so make sure the record and its
> +	 * sections stay within elog_buf before anything walks them.
> +	 */
> +	if (cper_estatus_len(tmp) > ELOG_ENTRY_LEN || cper_estatus_check(tmp))
> +		return NOTIFY_DONE;
> +
>   	if (!ras_userspace_consumers()) {
>   		print_extlog_rcd(NULL, tmp, cpu);
>   		goto out;

Reviewed-by: Shuai Xue <[email protected]>

Thanks.
Shuai