linux-kernel - Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0g8+XsUsYa0vNeCMcjx1wmMf99PfbYfofSqtaOqDajaow@mail.gmail.com>
Date: Mon, 18 Aug 2025 18:08:38 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Hanjun Guo <guohanjun@...wei.com>, Tony Luck <tony.luck@...el.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>, Borislav Petkov <bp@...en8.de>, 
	Mauro Carvalho Chehab <mchehab@...nel.org>, Shuai Xue <xueshuai@...ux.alibaba.com>, 
	Len Brown <lenb@...nel.org>, Zaid Alali <zaidal@...amperecomputing.com>, 
	linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org, 
	patches@...ts.linux.dev, "Lai, Yi1" <yi1.lai@...el.com>
Subject: Re: [PATCH] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection

On Mon, Aug 18, 2025 at 5:58 PM Hanjun Guo <guohanjun@...wei.com> wrote:
>
> On 2025/8/15 0:17, Tony Luck wrote:
> > On an EINJV2 capable system, users may still use the old injection
> > interface but einj_get_parameter_address() takes the EINJV2 path to map
> > the parameter structure. This results in the address the user supplied
> > being stored to the wrong location and the BIOS injecting based on an
> > uninitialized field (0x0 in the reported case).
> >
> > Check the version of the request when mapping the EINJ parameter
> > structure in BIOS reserved memory.
> >
> > Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters")
> > Reported-by: Lai, Yi1 <yi1.lai@...el.com>
> > Signed-off-by: Tony Luck <tony.luck@...el.com>
> > ---
> >   drivers/acpi/apei/einj-core.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c
> > index bf8dc92a373a..99f1b841fba9 100644
> > --- a/drivers/acpi/apei/einj-core.c
> > +++ b/drivers/acpi/apei/einj-core.c
> > @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
> >                       memcpy_fromio(&v5param, p, v5param_size);
> >                       acpi5 = 1;
> >                       check_vendor_extension(pa_v5, &v5param);
> > -                     if (available_error_type & ACPI65_EINJV2_SUPP) {
> > +                     if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
> >                               len = v5param.einjv2_struct.length;
> >                               offset = offsetof(struct einjv2_extension_struct, component_arr);
> >                               max_nr_components = (len - offset) /
>
> Reviewed-by: Hanjun Guo <gouhanjun@...wei.com>

Applied as 6.17-rc material, thanks!