Re: [PATCH] firmware: google: coreboot: validate table bounds

On Sat, Aug 01, 2026 at 10:41:51PM +0545, Laxman Acharya Padhya wrote:
> The existing coreboot_table_populate() bounds checks limit individual
> entries to the mapped length.
> However, coreboot_table_probe() replaces the platform resource length with
> header and table sizes supplied by firmware before mapping the full table.
> 
> A malformed table can overflow the 32-bit size addition or advertise an
> extent beyond the resource, causing the driver to map and parse memory
> outside the resource. A resource shorter than the fixed header is also
> mapped as though it contained a complete header.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-firmware-next

[1/1] firmware: google: coreboot: validate table bounds
      commit: a58a57a1076f8c5dae0327e3710899478c3be901

Thanks!