Re: [PATCH v3 01/10] ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length
Alison Schofield <[email protected]>
| Newsgroups | org.kernel.vger.linux-acpi,org.kernel.vger.linux-cxl |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Jul 17, 2026 at 09:16:38AM -0700, Dave Jiang wrote: > sashiko-bot flagged a missing bounds check that allows an > out-of-bounds read of the firmware CPER section. > > cxl_cper_post_event() copies a fixed sizeof(struct cxl_cper_event_rec) > out of the firmware CPER section without checking its length. Pass > gdata->error_data_length in and reject a section too small to hold the > record before the copy. > > Reported-by: [email protected] > Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6 > Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events") > Assisted-by: Claude:claude-opus-4-8 > Signed-off-by: Dave Jiang <[email protected]> Reviewed-by: Alison Schofield <[email protected]>