Re: [PATCH v4 09/13] ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy

On Mon, 24 Aug 2026 10:49:32 -0700
Dave Jiang <[email protected]> wrote:

> cxl_cper_setup_prot_err_work_data() locates the RAS Capability block at
> prot_err + sizeof(*prot_err) + dvsec_len and copies it, but dvsec_len is
> firmware controlled and never validated, so it can point the copy outside
> the section.
> 
> Extend cxl_cper_sec_prot_err_valid() to check that the section can hold
> the header, and that the header, DVSEC and RAS Capability block together
> fit the reported section length.
> 
> Reported-by: [email protected]
> Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6
> Link: https://lore.kernel.org/linux-cxl/[email protected]/
> Fixes: 315c2f0b53ba ("acpi/ghes, cper: Recognize and cache CXL Protocol errors")
> Reviewed-by: Alison Schofield <[email protected]>
> Reviewed-by: Shuai Xue <[email protected]>
> Reviewed-by: Ben Cheatham <[email protected]>
> Assisted-by: Claude:claude-sonnet-4-6
> Signed-off-by: Dave Jiang <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>