From nobody Wed Sep 30 03:45:52 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECA2F320CD1; Thu, 13 Aug 2026 15:11:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786633880; cv=none; b=G6UM018htAKE/16lW5S9i/96dVVBv56dDxHu5psyJde7mSHUDcnJ1wQZodfuiLHVbTIf+fpmM+V7aWkO2ruzx2viLLKwem1yPos6pikQVfWllFazP4O7375DPm3GvWx6k0SErq49M20DDx6PdxDClUXs/oMLW2f96mZMzPp9TKM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786633880; c=relaxed/simple; bh=EOHknXKR03tLn6shY7J3WMfMv6mpknYWTz0pPDrdGl8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=QpEk+szQgwLDfkb5Fl8NPrrWSIRkcDgpfQBMGyFa5rIQdBeGziROyBEDR6z8NiMnMT5r1SZ/90gU57icB29MLMLvCaJVfKnMZAB47ePIGrnNrU/23U4C48GrFTU05RrWORZBuqgwMa5DkeqVwp9BTq1GrCvfU5fEK6sti2q9Jf8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowADnu++P3n1qNB55BQ--.55902S2; Thu, 13 Aug 2026 23:11:11 +0800 (CST) From: Pengpeng Hou To: Dan Williams Cc: Vishal Verma , Dave Jiang , Alison Schofield , Ira Weiny , "Rafael J. Wysocki" , Len Brown , Jeff Moyer , Ross Zwisler , nvdimm@lists.linux.dev, linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 1/5] ACPI: NFIT: validate subtable extents before dispatch Date: Thu, 13 Aug 2026 23:11:11 +0800 Message-ID: <20260813151111.18434-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813150948.17239-1-pengpeng@iscas.ac.cn> References: <20260813150948.17239-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowADnu++P3n1qNB55BQ--.55902S2 X-Coremail-Antispam: 1UD129KBjvJXoW7tw1rAFW7Gr15Zr1kKFyDZFb_yoW8AF47p3 WUKa4ayrs8GFsFvw17Aa1FvFy5tws5AFy7K348A34q9w15G3W8JFy8KFy2qas5Jrs5CF4a vF4ktFy5AF4kZr7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9j14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v26rxl6s 0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xII jxv20xvE14v26r126r1DMcIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr 1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7M4IIrI8v6xkF7I0E8cxa n2IY04v7MxkF7I0En4kS14v26r1q6r43MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4 AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE 17CEb7AF67AKxVWUtVW8ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMI IF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4l IxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvf C2KfnxnUUI43ZEXa7VUbtxhJUUUUU== X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ add_table() checks only that the subtable cursor is before the end of the NFIT before reading the two-field subtable header. A cursor with fewer than sizeof(struct acpi_nfit_header) bytes remaining therefore makes the header read cross the mapped table. The function also advances by the firmware-provided length without checking that the advertised subtable fits in the enclosing NFIT. A malformed length can move the parser beyond the table and make the next iteration read unrelated memory. Require a complete header and bind the advertised length to both the header size and the bytes remaining in the NFIT before dispatching the subtable. Fixes: b94d5230d06e ("libnvdimm, nfit: initial libnvdimm infrastructure and= NFIT support") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- drivers/acpi/nfit/core.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index cb771d9cadb2..4428adb6a1ab 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -963,14 +963,18 @@ static void *add_table(struct acpi_nfit_desc *acpi_de= sc, struct device *dev =3D acpi_desc->dev; struct acpi_nfit_header *hdr; void *err =3D ERR_PTR(-ENOMEM); + size_t table_len; =20 if (table >=3D end) return NULL; + table_len =3D end - table; + if (table_len < sizeof(*hdr)) + return NULL; =20 hdr =3D table; - if (!hdr->length) { - dev_warn(dev, "found a zero length table '%d' parsing nfit\n", - hdr->type); + if (hdr->length < sizeof(*hdr) || hdr->length > table_len) { + dev_warn(dev, "invalid table length %u for type %u parsing nfit\n", + hdr->length, hdr->type); return NULL; } =20 --=20 2.50.1 (Apple Git-155) From nobody Wed Sep 30 03:45:52 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A15A04746A3; Thu, 13 Aug 2026 15:13:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634029; cv=none; b=FCXbMtpGXmNnz0NsssTBB2Lnu2OvRzGQiK3R+oWmZVqI7+FfhSsqreW/aMHEulXa+q0n39RLkdP4zCfT9SfMVTSNPqPnxE/2QLBftVHVEyoZ5GWL54xvh+FWBqyZM+l3icdCR0bIOPt2zS0mzvbcIcbRe9ecVdR3Edz9btzhakQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634029; c=relaxed/simple; bh=Uqnv31TYchVuebYUHgIZFHrFafrbMUbdtChxqy5njbw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Ntm4MYeRiwYfJ2/hEDj1oZZFYTKK82UHRRgpGp70Xtzc805yqddTL5Oo/VPBRftkPzJT8HWC+OMybO0lyB0YeHtMLwFyFJym/BSzHa6LtexbzGJDBUI2/lVlT8YOdw9xrgMPTuUGbZ3Y9IIACvva+QwAGftrvKPlBnJ/q+K7rTw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowAAHofQk331qCzZ5BQ--.20056S2; Thu, 13 Aug 2026 23:13:41 +0800 (CST) From: Pengpeng Hou To: Dan Williams Cc: Vishal Verma , Dave Jiang , Alison Schofield , Ira Weiny , "Rafael J. Wysocki" , Len Brown , Jeff Moyer , Ross Zwisler , nvdimm@lists.linux.dev, linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 2/5] ACPI: NFIT: accept SPA structures with an unused location cookie Date: Thu, 13 Aug 2026 23:13:40 +0800 Message-ID: <20260813151340.20276-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813150948.17239-1-pengpeng@iscas.ac.cn> References: <20260813150948.17239-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowAAHofQk331qCzZ5BQ--.20056S2 X-Coremail-Antispam: 1UD129KBjvJXoWxGryUGr1UXF4UJF17tw4ktFb_yoW5WF15pF sIka4SyF9rJr47CF43Ww45J34Ykwn7ZF48ArZrC34qy3Z3Xr12kFn7KFyYqFyrtrWv9w43 CF4ktFW5CrWqvw7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9Y14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4j 6r4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8Jw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWU CwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCT nIWIevJa73UjIFyTuYvjfUoq2MUUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ ACPI 6.4 extended the System Physical Address Range Structure from 56 to 64 bytes by appending an eight-byte location cookie. The cookie-valid flag describes whether that field contains usable data; it does not select the structure length. sizeof_spa() instead derives the expected length from the flag. It therefore rejects a valid 64-byte ACPI 6.4 structure when the cookie is present but not valid. It can also compare 64 bytes against a previously saved 56-byte structure without first checking that the saved allocation has the same length. Accept either the legacy 56-byte layout or the ACPI 6.4 64-byte layout. Require the cookie-valid flag to be clear for the legacy layout, and compare saved entries only when their validated lengths match. Fixes: e9cfd259c6d3 ("ACPI: NFIT: Fix support for variable 'SPA' structure = size") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- drivers/acpi/nfit/core.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 4428adb6a1ab..f68edfe64952 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -705,9 +705,20 @@ int nfit_spa_type(struct acpi_nfit_system_address *spa) =20 static size_t sizeof_spa(struct acpi_nfit_system_address *spa) { + size_t legacy_size =3D offsetof(struct acpi_nfit_system_address, + location_cookie); + size_t size =3D spa->header.length; + + if (size =3D=3D sizeof(*spa)) + return size; + + if (size !=3D legacy_size) + return 0; + if (spa->flags & ACPI_NFIT_LOCATION_COOKIE_VALID) - return sizeof(*spa); - return sizeof(*spa) - 8; + return 0; + + return size; } =20 static bool add_spa(struct acpi_nfit_desc *acpi_desc, @@ -716,23 +727,26 @@ static bool add_spa(struct acpi_nfit_desc *acpi_desc, { struct device *dev =3D acpi_desc->dev; struct nfit_spa *nfit_spa; + size_t size =3D sizeof_spa(spa); =20 - if (spa->header.length !=3D sizeof_spa(spa)) + if (!size) return false; =20 list_for_each_entry(nfit_spa, &prev->spas, list) { - if (memcmp(nfit_spa->spa, spa, sizeof_spa(spa)) =3D=3D 0) { + if (sizeof_spa(nfit_spa->spa) !=3D size) + continue; + + if (memcmp(nfit_spa->spa, spa, size) =3D=3D 0) { list_move_tail(&nfit_spa->list, &acpi_desc->spas); return true; } } =20 - nfit_spa =3D devm_kzalloc(dev, sizeof(*nfit_spa) + sizeof_spa(spa), - GFP_KERNEL); + nfit_spa =3D devm_kzalloc(dev, sizeof(*nfit_spa) + size, GFP_KERNEL); if (!nfit_spa) return false; INIT_LIST_HEAD(&nfit_spa->list); - memcpy(nfit_spa->spa, spa, sizeof_spa(spa)); + memcpy(nfit_spa->spa, spa, size); list_add_tail(&nfit_spa->list, &acpi_desc->spas); dev_dbg(dev, "spa index: %d type: %s\n", spa->range_index, --=20 2.50.1 (Apple Git-155) From nobody Wed Sep 30 03:45:52 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 228703B71A4; Thu, 13 Aug 2026 15:16:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634184; cv=none; b=E5m+teYBZbrqYeINFgeFhXUE5Oiftbh1NeMwDtTNq8ngfT0kmUfafGv9ilJsCtISAZnabCeXyDTdBqqfqlvKm1CWT0LhOqmcW3g6XvUX16CvuiNJxHQKj7M9puX6ZsqrI/NBShhFDoxLkLIJN6r4LTdWgDVEd1MpqLfawz3tuzU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634184; c=relaxed/simple; bh=xdf0t7m7Bhn3KmbAQhElZb+68JO5fpEcRK1bl1cz6yM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=WcqxYVljG2OWvdzr831/SvPmGUdooc/sAgSW+v5TnDPenSddngaPD79+Y9/B2Y3u+XPEJwpzmD92wIWmn/QsPUvzILoPLB3MEXOBk5nUzpGJpdIX4ElQKiW0rZAn3KKOay7vmqj7A3wu0+PA4//qjOyFrrbY0Fxsd7ywSQ9x3oM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowAB3Se29331qEEx5BQ--.9196S2; Thu, 13 Aug 2026 23:16:14 +0800 (CST) From: Pengpeng Hou To: Dan Williams Cc: Vishal Verma , Dave Jiang , Alison Schofield , Ira Weiny , "Rafael J. Wysocki" , Len Brown , Jeff Moyer , Ross Zwisler , nvdimm@lists.linux.dev, linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 3/5] ACPI: NFIT: validate interleave and flush array extents Date: Thu, 13 Aug 2026 23:16:12 +0800 Message-ID: <20260813151612.21777-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813150948.17239-1-pengpeng@iscas.ac.cn> References: <20260813150948.17239-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowAB3Se29331qEEx5BQ--.9196S2 X-Coremail-Antispam: 1UD129KBjvJXoW7CF45CF4xur1UurW5Zw4fZrb_yoW8ury5pF 40gasFyr4xJr13G3y3tw4rAw45Aan3AF12yFy8Ca43A3Zakr4UGF4rKFyYqFy5Xrn3Cw43 uF4kKa45uFWkZr7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9Y14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4j 6r4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8Jw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWU CwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCT nIWIevJa73UjIFyTuYvjfUoq2MUUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Interleave and flush subtables carry a fixed header followed by arrays whose element counts come from firmware. sizeof_idt() and sizeof_flush() derive the copy size from those counts but do not require the result to fit in the subtable's advertised length. A short subtable with a large line_count or hint_count can consequently make add_idt() or add_flush() copy beyond the subtable. The outer NFIT extent check cannot catch this because the following subtable bytes are still inside the enclosing ACPI table. Use struct_size() for both variable arrays and reject a derived size that exceeds the current subtable. Fixes: b94d5230d06e ("libnvdimm, nfit: initial libnvdimm infrastructure and= NFIT support") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- drivers/acpi/nfit/core.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index f68edfe64952..bf4ddc56494e 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -882,9 +882,16 @@ static bool add_bdw(struct acpi_nfit_desc *acpi_desc, =20 static size_t sizeof_idt(struct acpi_nfit_interleave *idt) { + size_t size; + if (idt->header.length < sizeof(*idt)) return 0; - return sizeof(*idt) + sizeof(u32) * idt->line_count; + + size =3D struct_size(idt, line_offset, idt->line_count); + if (size > idt->header.length) + return 0; + + return size; } =20 static bool add_idt(struct acpi_nfit_desc *acpi_desc, @@ -921,9 +928,16 @@ static bool add_idt(struct acpi_nfit_desc *acpi_desc, =20 static size_t sizeof_flush(struct acpi_nfit_flush_address *flush) { + size_t size; + if (flush->header.length < sizeof(*flush)) return 0; - return struct_size(flush, hint_address, flush->hint_count); + + size =3D struct_size(flush, hint_address, flush->hint_count); + if (size > flush->header.length) + return 0; + + return size; } =20 static bool add_flush(struct acpi_nfit_desc *acpi_desc, --=20 2.50.1 (Apple Git-155) From nobody Wed Sep 30 03:45:52 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0407E46AA7B; Thu, 13 Aug 2026 15:18:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634333; cv=none; b=YgUYZ4KYmXQs1MCb1P9ruvS46Ch58OisR2wXdCtDGkTeSlagVbUvlvsv0PGF7MSvecIn3qaUnv4uA9s4BbAfTzMeOddFu7TbjJ1DRcIYutgc9i59d40AO/H9u5s6ALBe2i1wPubO/mCws6bv+ywozbzxFsFLqyzpj6ugKOWMRiQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634333; c=relaxed/simple; bh=yuDC1gRxHvrdCLXoPP0tdkI+BRFORJkxV2MDo3+744w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ru5rcLhegcDKoDWOqTxBCGGcr8qYG5l9vez7DlYXn3gg9bhbOwD79AIVDGlPs5iHJRLAgbzHPRl6/x0fsuPB4w6SaDLrKmGBMps9dERhIsWeoxfWR4OqLYCh7ThOVTjLJqEUzib88a5cXb5E0130fHn0pMp4vHy+eWoktRp7xdE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowAAX7O9T4H1qDWZ5BQ--.56168S2; Thu, 13 Aug 2026 23:18:44 +0800 (CST) From: Pengpeng Hou To: Dan Williams Cc: Vishal Verma , Dave Jiang , Alison Schofield , Ira Weiny , "Rafael J. Wysocki" , Len Brown , Jeff Moyer , Ross Zwisler , nvdimm@lists.linux.dev, linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 4/5] ACPI: NFIT: validate control region extent Date: Thu, 13 Aug 2026 23:18:43 +0800 Message-ID: <20260813151843.24305-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813150948.17239-1-pengpeng@iscas.ac.cn> References: <20260813150948.17239-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowAAX7O9T4H1qDWZ5BQ--.56168S2 X-Coremail-Antispam: 1UD129KBjvJXoW7tryrZF1Dtry8tr1DJF13Jwb_yoW8Ary8pF 4Ut3sxArn7ta15Aw12kw45Zay5Zan3AF47C397J342kr9akw1UJF90yFyYqayUJrs7GrW3 CF4ktF95AF98Ar7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9Y14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4j 6r4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8Jw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWU CwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCT nIWIevJa73UjIFyTuYvjfUoq2MUUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ A control region with no block windows may legally stop before the window-size fields, so sizeof_dcr() first reads the windows count from the shortened fixed portion. When the count is nonzero, however, the helper returns sizeof(*dcr) without checking that the advertised subtable contains the remaining fields. add_dcr() then copies that full size. A malformed subtable that ends immediately after a nonzero windows count can therefore make the copy read beyond the control region. Compute the required size from the windows count and require that size to fit in the advertised subtable before returning it. Fixes: b94d5230d06e ("libnvdimm, nfit: initial libnvdimm infrastructure and= NFIT support") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- drivers/acpi/nfit/core.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index bf4ddc56494e..84c70f1941c5 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -817,12 +817,20 @@ EXPORT_SYMBOL_GPL(nfit_get_smbios_id); */ static size_t sizeof_dcr(struct acpi_nfit_control_region *dcr) { + size_t size; + if (dcr->header.length < offsetof(struct acpi_nfit_control_region, window_size)) return 0; if (dcr->windows) - return sizeof(*dcr); - return offsetof(struct acpi_nfit_control_region, window_size); + size =3D sizeof(*dcr); + else + size =3D offsetof(struct acpi_nfit_control_region, window_size); + + if (size > dcr->header.length) + return 0; + + return size; } =20 static bool add_dcr(struct acpi_nfit_desc *acpi_desc, --=20 2.50.1 (Apple Git-155) From nobody Wed Sep 30 03:45:52 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2979D48551C; Thu, 13 Aug 2026 15:20:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634446; cv=none; b=iuCg1icw/rRGzUjwVOM/NlBr1G4QoBjmb/zTYpJ8kRx2n+E4LFugF91pu1eNbjYJ84h578jubTZzaSfB1TQwpn2ifiuSeJ/9WZizHLafa7DVRDlACCw0s5yPYBNwQLjPMpwlBJX1b9jTjwjvLfM5EdmZqHojkZ7Y9IwsOBDBXDw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786634446; c=relaxed/simple; bh=I9t4BQUYK3njp/kCF9ay0weQak0qIG7++Gl7VIfpS1M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=EEqjXOgioCjk5ec8Y2ENdsmbNjzb5fkyt2hGGWyR9Ae1h+XbD9r10miw0AsJ7wE3gIg1gBRawzC67TwJ5P4NCYE5MiuUUvrzkMJByqiDJTodLzaAGBL0mJNwXu5tFBjGrYHqGwa4noPiRAu0mxBoC4iMo/aHeKkkx3QwgDsoRYA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowAAn+ezG4H1qJHR5BQ--.54510S2; Thu, 13 Aug 2026 23:20:38 +0800 (CST) From: Pengpeng Hou To: Dan Williams Cc: Vishal Verma , Dave Jiang , Alison Schofield , Ira Weiny , "Rafael J. Wysocki" , Len Brown , Jeff Moyer , Ross Zwisler , nvdimm@lists.linux.dev, linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 5/5] ACPI: NFIT: bound the platform capability mask Date: Thu, 13 Aug 2026 23:20:37 +0800 Message-ID: <20260813152037.25828-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813150948.17239-1-pengpeng@iscas.ac.cn> References: <20260813150948.17239-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowAAn+ezG4H1qJHR5BQ--.54510S2 X-Coremail-Antispam: 1UD129KBjvJXoWxJry7ur47GF45GF1DWw1ftFb_yoW8WF1rpr Z7K3W3K3ykWF4ayw4qyr40vFy5AasYvFy7GFW8W343uwnxu3WqyF1DCFyrtF1jyFnaga15 AFZ2ya95uFWDZaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9Y14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4j 6r4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8Jw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWU CwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCT nIWIevJa73UjIFyTuYvjfUoq2MUUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ The platform capability subtable parser reads highest_capability and capabilities without first requiring the fixed structure to be present. It also shifts a signed integer by highest_capability + 1. Firmware can therefore trigger an out-of-bounds read with a short subtable and an undefined shift with a value at or above 31. Require the fixed structure before reading either field. For capability indices that cover all bits representable by the current u32 field, use U32_MAX. This ignores capabilities beyond the implemented 32-bit field rather than rejecting future firmware that advertises a higher index. Fixes: 06e8ccdab15f ("acpi: nfit: Add support for detect platform CPU cache= flush on power loss") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- drivers/acpi/nfit/core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 84c70f1941c5..7638d4dc8c6d 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -987,7 +987,14 @@ static bool add_platform_cap(struct acpi_nfit_desc *ac= pi_desc, struct device *dev =3D acpi_desc->dev; u32 mask; =20 - mask =3D (1 << (pcap->highest_capability + 1)) - 1; + if (pcap->header.length < sizeof(*pcap)) + return false; + + if (pcap->highest_capability >=3D 31) + mask =3D U32_MAX; + else + mask =3D (1U << (pcap->highest_capability + 1)) - 1; + acpi_desc->platform_cap =3D pcap->capabilities & mask; dev_dbg(dev, "cap: %#x\n", acpi_desc->platform_cap); return true; --=20 2.50.1 (Apple Git-155)