linux-kernel - Re: [PATCH] ACPI: PPTT: Fix processor subtable walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJZ5v0jOmeKy84N0My7o+PvAybjdaxv9ZS8HT=X0momY7rzTuQ@mail.gmail.com>
Date: Thu, 8 May 2025 20:26:23 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Sudeep Holla <sudeep.holla@....com>
Cc: Jeremy Linton <jeremy.linton@....com>, rafael@...nel.org, lenb@...nel.org, 
	jmeurin@...gle.com, linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Maximilian Heyne <mheyne@...zon.de>, Yicong Yang <yangyicong@...ilicon.com>, stable@...r.kernel.org
Subject: Re: [PATCH] ACPI: PPTT: Fix processor subtable walk

On Thu, May 8, 2025 at 11:13 AM Sudeep Holla <sudeep.holla@....com> wrote:
>
> On Wed, May 07, 2025 at 09:30:25PM -0500, Jeremy Linton wrote:
> > The original PPTT code had a bug where the processor subtable length
> > was not correctly validated when encountering a truncated
> > acpi_pptt_processor node.
> >
> > Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of
> > sizeof() calls") attempted to fix this by validating the size is as
> > large as the acpi_pptt_processor node structure. This introduced a
> > regression where the last processor node in the PPTT table is ignored
> > if it doesn't contain any private resources. That results errors like:
> >
> >   ACPI PPTT: PPTT table found, but unable to locate core XX (XX)
> >   ACPI: SPE must be homogeneous
> >
> > Furthermore, it fail in a common case where the node length isn't
> > equal to the acpi_pptt_processor structure size, leaving the original
> > bug in a modified form.
> >
> > Correct the regression by adjusting the loop termination conditions as
> > suggested by the bug reporters. An additional check performed after
> > the subtable node type is detected, validates the acpi_pptt_processor
> > node is fully contained in the PPTT table. Repeating the check in
> > acpi_pptt_leaf_node() is largely redundant as the node is already
> > known to be fully contained in the table.
> >
> > The case where a final truncated node's parent property is accepted,
> > but the node itself is rejected should not be considered a bug.
> >
>
> Thanks for picking this up and describing the issue properly in the commit
> message.
>
> Reviewed-by: Sudeep Holla <sudeep.holla@....com>

Applied, but it is a bit too late to push it for -rc6, so I'll queue
it up for -rc7.

Thanks!