Re: [PATCH v4 08/13] ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length

On Mon, 24 Aug 2026 10:49:31 -0700
Dave Jiang <[email protected]> wrote:

> cxl_cper_post_event() copies a fixed sizeof(struct cxl_cper_event_rec)
> out of the firmware CPER section without checking how long the section
> actually is, so a short one reads past the record.
> 
> Pass gdata->error_data_length in and reject a section too small to hold
> the record before the copy.
> 
> Reported-by: [email protected]
> Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6
> Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events")
> Reviewed-by: Alison Schofield <[email protected]>
> Reviewed-by: Shuai Xue <[email protected]>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dave Jiang <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>