From 179ef6d7f971d72a0f54b7c499daed1b244ee1a5 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Fri, 4 Sep 2026 10:23:28 -0700 Subject: ACPI: extlog: Defer CXL protocol error handling to avoid lock inversion extlog_print() calls cxl_cper_handle_prot_err() synchronously while the MCE notifier chain rwsem is held, and that path takes the PCI device_lock via guard(device)(). The probe path takes the two in the opposite order, holding device_lock while mce_register_decode_chain() takes the rwsem, so they can deadlock AB-BA. ghes.c already avoids this by posting protocol errors to a kfifo and handling them from a workqueue via cxl_cper_post_prot_err(). Export that function and call it instead. Declare it with the other CONFIG_ACPI_APEI_GHES exports rather than at the end of the header. No #else stub: ACPI_EXTLOG selects ACPI_APEI_GHES, so the only caller cannot exist without it. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/ Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-5-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki --- include/acpi/ghes.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include/acpi') diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index 8d7e5caef3f1..be496bc0386f 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -85,6 +85,10 @@ int devm_ghes_register_vendor_record_notifier(struct device *dev, struct list_head *ghes_get_devices(void); void ghes_estatus_pool_region_free(unsigned long addr, u32 size); + +struct cxl_cper_sec_prot_err; +void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err, + int severity); #else static inline struct list_head *ghes_get_devices(void) { return NULL; } -- cgit v1.2.3 From 8bf58815315aeb60125d26404d6fa7d576d5d518 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Fri, 4 Sep 2026 10:23:33 -0700 Subject: ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy cxl_cper_setup_prot_err_work_data() locates the RAS Capability block at prot_err + sizeof(*prot_err) + dvsec_len and copies it, but dvsec_len is firmware controlled and never validated, so it can point the copy outside the section. Extend cxl_cper_sec_prot_err_valid() to check that the section can hold the header, and that the header, DVSEC and RAS Capability block together fit the reported section length. Reported-by: sashiko-bot@kernel.org Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6 Link: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/ Fixes: 315c2f0b53ba ("acpi/ghes, cper: Recognize and cache CXL Protocol errors") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Ben Cheatham Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-10-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki --- include/acpi/ghes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/acpi') diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index be496bc0386f..7acf209061ea 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -88,7 +88,7 @@ void ghes_estatus_pool_region_free(unsigned long addr, u32 size); struct cxl_cper_sec_prot_err; void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err, - int severity); + int severity, u32 len); #else static inline struct list_head *ghes_get_devices(void) { return NULL; } -- cgit v1.2.3