Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 3 Dec 2018 12:19:10 +0800
From:   Chao Fan <fanc.fnst@cn.fujitsu.com>
To:     Masayoshi Mizuma <msys.mizuma@gmail.com>
CC:     <linux-kernel@vger.kernel.org>, <x86@kernel.org>, <bp@alien8.de>,
        <tglx@linutronix.de>, <mingo@redhat.com>, <hpa@zytor.com>,
        <keescook@chromium.org>, <bhe@redhat.com>,
        <indou.takao@jp.fujitsu.com>, <caoj.fnst@cn.fujitsu.com>
Subject: Re: [PATCH v12 4/5] x86/boot: Parse SRAT table from RSDP and store
 immovable memory
Message-ID: <20181203041910.GE30941@localhost.localdomain>
References: <20181129081631.11139-1-fanc.fnst@cn.fujitsu.com>
 <20181129081631.11139-5-fanc.fnst@cn.fujitsu.com>
 <20181129175520.xcmj3bv4yhdr7kk3@gabell>
 <20181130012454.GB1527@localhost.localdomain>
 <20181130145432.j2iwbglwrtj5xdus@gabell>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20181130145432.j2iwbglwrtj5xdus@gabell>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Nov 30, 2018 at 09:54:33AM -0500, Masayoshi Mizuma wrote:
>On Fri, Nov 30, 2018 at 09:24:54AM +0800, Chao Fan wrote:
>> >>  /* acpitb.c */
>> >> +#ifdef CONFIG_RANDOMIZE_BASE
>> >> +/* Store the amount of immovable memory regions */
>> >> +int num_immovable_mem;
>> >> +#endif
>> >> +
>> >> +#ifdef CONFIG_EARLY_PARSE_RSDP
>> >> +void get_immovable_mem(void);
>> >
>> >> +/* There are 72 kinds of ACPI_SIG in head file of ACPI. */
>> >> +#define MAX_ACPI_SIG	72
>> >
>> >The 72 isn't the specification of ACPI, right? So the number
>> 
>> Yes, it's from  ACPI code, include/acpi/actbl*h.
>> Boris said there should be a check for the num_entries,
>> I didn't get a good idea, so I use the max number to check it.
>> So do you have some advice?
>
>Ah, got it. How about adding the check for len to prevent the wrap?
>Like as:
>
>	len = header->length;
>	if (len <= sizeof(struct acpi_table_header))
>		return NULL;
> 	num_entries = (u32)((len - sizeof(struct acpi_table_header)) / size);

Hi Masa,

Your check is right, but not exactly the same.
I think what Boris said is to prevent num_entries from getting too large
and the loop getting too much.
So the 'num_entries' or 'len' can't be more than a fixed value.

Thanks,
Chao Fan

>
>Thanks,
>Masa
>
>