linux-kernel - Re: [PATCH next] ACPI: APEI: EINJ: prevent memory corruption in error_type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <685c684533e1c_2c354429441@iweiny-mobl.notmuch>
Date: Wed, 25 Jun 2025 16:21:09 -0500
From: Ira Weiny <ira.weiny@...el.com>
To: Dan Carpenter <dan.carpenter@...aro.org>, Zaid Alali
	<zaidal@...amperecomputing.com>
CC: "Rafael J. Wysocki" <rafael@...nel.org>, Len Brown <lenb@...nel.org>,
	James Morse <james.morse@....com>, Tony Luck <tony.luck@...el.com>, "Borislav
 Petkov" <bp@...en8.de>, Ira Weiny <ira.weiny@...el.com>, Jonathan Cameron
	<Jonathan.Cameron@...wei.com>, Al Viro <viro@...iv.linux.org.uk>, "Sudeep
 Holla" <sudeep.holla@....com>, Jon Hunter <jonathanh@...dia.com>,
	<linux-acpi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<kernel-janitors@...r.kernel.org>
Subject: Re: [PATCH next] ACPI: APEI: EINJ: prevent memory corruption in
 error_type_set()

Dan Carpenter wrote:
> The "einj_buf" buffer is 32 chars.  If "count" is larger than that it
> results in memory corruption.  Cap it at 31 so that we leave the last
> character as a NUL terminator.  By the way, the highest reasonable value
> for "count" is 24.
> 
> Fixes: 0c6176e1e186 ("ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>

Reviewed-by: Ira Weiny <ira.weiny@...el.com>

[snip]