linux-kernel - Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aJ5KIMK6ALKXdVmY@zaid>
Date: Thu, 14 Aug 2025 13:42:08 -0700
From: Zaid Alali <zaidal@...amperecomputing.com>
To: Tony Luck <tony.luck@...el.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
	Borislav Petkov <bp@...en8.de>, Hanjun Guo <guohanjun@...wei.com>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	Shuai Xue <xueshuai@...ux.alibaba.com>, Len Brown <lenb@...nel.org>,
	linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org,
	patches@...ts.linux.dev, "Lai, Yi1" <yi1.lai@...el.com>
Subject: Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2
 injection

On Thu, Aug 14, 2025 at 09:17:06AM -0700, Tony Luck wrote:
> On an EINJV2 capable system, users may still use the old injection
> interface but einj_get_parameter_address() takes the EINJV2 path to map
> the parameter structure. This results in the address the user supplied
> being stored to the wrong location and the BIOS injecting based on an
> uninitialized field (0x0 in the reported case).
> 
> Check the version of the request when mapping the EINJ parameter
> structure in BIOS reserved memory.
> 
> Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
> Reported-by: Lai, Yi1 <yi1.lai@...el.com>
> Signed-off-by: Tony Luck <tony.luck@...el.com>

Looks good to me.

Reviewed-by: Zaid Alali <zaidal@...amperecomputing.com>

> ---
>  drivers/acpi/apei/einj-core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
> index bf8dc92a373a..99f1b841fba9 100644
> --- a/drivers/acpi/apei/einj-core.c
> +++ b/drivers/acpi/apei/einj-core.c
> @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
>  			memcpy_fromio(&v5param, p, v5param_size);
>  			acpi5 = 1;
>  			check_vendor_extension(pa_v5, &v5param);
> -			if (available_error_type & ACPI65_EINJV2_SUPP) {
> +			if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
>  				len = v5param.einjv2_struct.length;
>  				offset = offsetof(struct einjv2_extension_struct, component_arr);
>  				max_nr_components = (len - offset) /
> -- 
> 2.50.1
>