diff options
| author | Dave Jiang <dave.jiang@intel.com> | 2026-09-04 10:23:32 -0700 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2026-09-04 20:22:05 +0200 |
| commit | b7a4915a2b43d47f0bbb0b2a4c30e722fa0d3191 (patch) | |
| tree | 020d5324467448cd42b8d2c2b2b4c70cdacdd042 /include/linux/stackprotector.h | |
| parent | 44a8d464d79b60883f7bd386049a1ffff32ca690 (diff) | |
ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length
cxl_cper_post_event() copies a fixed sizeof(struct cxl_cper_event_rec)
out of the firmware CPER section without checking how long the section
actually is, so a short one reads past the record.
Pass gdata->error_data_length in and reject a section too small to hold
the record before the copy.
Reported-by: sashiko-bot@kernel.org
Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6
Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events")
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260904172337.1409775-9-dave.jiang@intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'include/linux/stackprotector.h')
0 files changed, 0 insertions, 0 deletions