linux-kernel - Re: [PATCH] ACPI: PPTT: Fix processor subtable walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250508-abiding-enigmatic-mustang-ab3bd2@sudeepholla>
Date: Thu, 8 May 2025 10:12:58 +0100
From: Sudeep Holla <sudeep.holla@....com>
To: Jeremy Linton <jeremy.linton@....com>
Cc: <rafael@...nel.org>, <lenb@...nel.org>, <jmeurin@...gle.com>,
	<linux-acpi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Maximilian Heyne <mheyne@...zon.de>,
	Sudeep Holla <sudeep.holla@....com>,
	Yicong Yang <yangyicong@...ilicon.com>, <stable@...r.kernel.org>
Subject: Re: [PATCH] ACPI: PPTT: Fix processor subtable walk

On Wed, May 07, 2025 at 09:30:25PM -0500, Jeremy Linton wrote:
> The original PPTT code had a bug where the processor subtable length
> was not correctly validated when encountering a truncated
> acpi_pptt_processor node.
> 
> Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of
> sizeof() calls") attempted to fix this by validating the size is as
> large as the acpi_pptt_processor node structure. This introduced a
> regression where the last processor node in the PPTT table is ignored
> if it doesn't contain any private resources. That results errors like:
> 
>   ACPI PPTT: PPTT table found, but unable to locate core XX (XX)
>   ACPI: SPE must be homogeneous
> 
> Furthermore, it fail in a common case where the node length isn't
> equal to the acpi_pptt_processor structure size, leaving the original
> bug in a modified form.
> 
> Correct the regression by adjusting the loop termination conditions as
> suggested by the bug reporters. An additional check performed after
> the subtable node type is detected, validates the acpi_pptt_processor
> node is fully contained in the PPTT table. Repeating the check in
> acpi_pptt_leaf_node() is largely redundant as the node is already
> known to be fully contained in the table.
> 
> The case where a final truncated node's parent property is accepted,
> but the node itself is rejected should not be considered a bug.
> 

Thanks for picking this up and describing the issue properly in the commit
message.

Reviewed-by: Sudeep Holla <sudeep.holla@....com>

-- 
Regards,
Sudeep