linux-kernel - Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <230e2659-7838-2165-4490-3b3f89cb7838@huawei.com>
Date: Mon, 18 Aug 2025 23:58:14 +0800
From: Hanjun Guo <guohanjun@...wei.com>
To: Tony Luck <tony.luck@...el.com>, "Rafael J. Wysocki"
	<rafael.j.wysocki@...el.com>
CC: Borislav Petkov <bp@...en8.de>, Mauro Carvalho Chehab
	<mchehab@...nel.org>, Shuai Xue <xueshuai@...ux.alibaba.com>, Len Brown
	<lenb@...nel.org>, Zaid Alali <zaidal@...amperecomputing.com>,
	<linux-acpi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<patches@...ts.linux.dev>, "Lai, Yi1" <yi1.lai@...el.com>
Subject: Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2
 injection

On 2025/8/15 0:17, Tony Luck wrote:
> On an EINJV2 capable system, users may still use the old injection
> interface but einj_get_parameter_address() takes the EINJV2 path to map
> the parameter structure. This results in the address the user supplied
> being stored to the wrong location and the BIOS injecting based on an
> uninitialized field (0x0 in the reported case).
> 
> Check the version of the request when mapping the EINJ parameter
> structure in BIOS reserved memory.
> 
> Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
> Reported-by: Lai, Yi1 <yi1.lai@...el.com>
> Signed-off-by: Tony Luck <tony.luck@...el.com>
> ---
>   drivers/acpi/apei/einj-core.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
> index bf8dc92a373a..99f1b841fba9 100644
> --- a/drivers/acpi/apei/einj-core.c
> +++ b/drivers/acpi/apei/einj-core.c
> @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
>   			memcpy_fromio(&v5param, p, v5param_size);
>   			acpi5 = 1;
>   			check_vendor_extension(pa_v5, &v5param);
> -			if (available_error_type & ACPI65_EINJV2_SUPP) {
> +			if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
>   				len = v5param.einjv2_struct.length;
>   				offset = offsetof(struct einjv2_extension_struct, component_arr);
>   				max_nr_components = (len - offset) /

Reviewed-by: Hanjun Guo <gouhanjun@...wei.com>

Thanks
Hanjun