Received-SPF: pass (google.com: domain of linux-kernel+bounces-30656-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Thu, 18 Jan 2024 16:32:33 -0800
From: Dan Williams <dan.j.williams@intel.com>
To: Robert Richter <rrichter@amd.com>, Alison Schofield
	<alison.schofield@intel.com>, Vishal Verma <vishal.l.verma@intel.com>, "Ira
 Weiny" <ira.weiny@intel.com>, Dan Williams <dan.j.williams@intel.com>,
	Jonathan Cameron <jonathan.cameron@huawei.com>, Dave Jiang
	<dave.jiang@intel.com>, Davidlohr Bueso <dave@stgolabs.net>, "Rafael J.
 Wysocki" <rafael@kernel.org>, Andrew Morton <akpm@linux-foundation.org>
CC: <linux-cxl@vger.kernel.org>, <linux-kernel@vger.kernel.org>, Len Brown
	<lenb@kernel.org>, Robert Richter <rrichter@amd.com>,
	<linux-acpi@vger.kernel.org>
Subject: RE: [PATCH v2 3/3] lib/firmware_table: Provide buffer length
 argument to cdat_table_parse()
Message-ID: <65a9c321785ea_37ad294ce@dwillia2-xfh.jf.intel.com.notmuch>
References: <20240108114833.241710-1-rrichter@amd.com>
 <20240108114833.241710-4-rrichter@amd.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20240108114833.241710-4-rrichter@amd.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?4BtNH9FgLomgvAJLvC+m/VpX7FYB+3TUbG9hKZFnrTWSGzU3TM/QStNTswLx?=
 =?us-ascii?Q?neB3SHakMRBCRq1/SDT1sj2da945haDgpSXW/5BOmvYVAYoxbCF0LD9NnQF0?=
 =?us-ascii?Q?vhZOU5x6pa+CgILpsZKLywwFKIuFC08ImtUqfoTKb1S761t4fpEUefM2S/la?=
 =?us-ascii?Q?qdyEoVmkT9bpCPmagvnN81TXJABG+3UGo2Xbuvmud7qIqkVbIPKlwZTabx5d?=
 =?us-ascii?Q?cTR4rHNQ58pmYKKkOU66i99x9MCey9adBEbFq6NSiMlamMF0rz+WdmOnR0Wr?=
 =?us-ascii?Q?SxnDFNkvm0E0/tTtwbk7W1F6wJPoagkrXi5gpTspkf/immQew1Fl1dVO3M1a?=
 =?us-ascii?Q?mOSgI1JoJcImCT/OnN5SAjocMbj0rultHD5BSFcLueYPn3Q7yMLh/VIodGY5?=
 =?us-ascii?Q?ZV08+U753dEgdrH8L08K7CgzA16ldjrX0IOJji+NfQIFLaChtee10u8DdWur?=
 =?us-ascii?Q?xNnMAqttWaf0f0fZ2y5IieZc11c1jvePvv1bdIs1CLIsj/ygXAwCtnRzen8Q?=
 =?us-ascii?Q?Eoz8PCHlkNzhxgAALjaxcif4CnpnhpBza/dxe26dloURcepr/ETV2MdKglc4?=
 =?us-ascii?Q?0hF8eBCc2bOK/rRxeuWvWcC+FnbyJAIKWEqB06QfTXhTS76P3SyyndagfBau?=
 =?us-ascii?Q?Ja2oc1se5eKBiNaYhpScYqKNa1gaN6M4MinsGWDikJ6rzdntOFJkiD+IbG8t?=
 =?us-ascii?Q?dq07xsBQMyLfuXc83HW7c9gFOwxbkbBjS9225V7yGwkDjjvvnd6ArrMz6IHT?=
 =?us-ascii?Q?9pdcaJTWLIFgRLb4VPGfqCwXSZsxB4YNfyPVCC3FcChNifQFebo7UNzFU5AG?=
 =?us-ascii?Q?qitVdYrMrzsfVUEB1M8hFiBcuU5QB504g3OpybUIWPG7NLvMfYy0BusAJ07U?=
 =?us-ascii?Q?vBrGYGoUP7IWJo1YrqJD4JFUoxtp1umhrwCDGFFTOgmIpk7F8rpXMUQNwfv3?=
 =?us-ascii?Q?z7kIMZ8YzszOPgwT2qINJI9ygP/yHM/uVu/JrTlbdPAIkYP0fWXsWgkohXJg?=
 =?us-ascii?Q?FYyCINL2TKuI8dbHxU2p4EO3YGCA3iTp4eohVoxEqbk/76Zdx1yGOnh9PHdh?=
 =?us-ascii?Q?eojy8ELCF2jrx06dbNYcUVdKTXDBng3xDdJ6/L8LHpRxFJDwDBnYRMQVZ0Nx?=
 =?us-ascii?Q?xVOC6bZlLzxjD3ezp0yxaS861EjJHaGmyyyT0OL465xm3Z5YYRQNwO9RWj8K?=
 =?us-ascii?Q?35e7Aq+LV7ibDpbBtHSFpKJp3vqAR6ZtPZh9Ek9GFYmTsHvyqGGTEZlA8Fvx?=
 =?us-ascii?Q?K8oIK893BFmgmn2ZIKbhHw7YhDb6J0aWMDARbu8wU0pkMXhGsBGErw8q50k7?=
 =?us-ascii?Q?hWj+lzZxhydL9jqXkkLFkPzQNEWByBGqP1R/kIPdmO52E29jC+XcusUF6Hq+?=
 =?us-ascii?Q?ljpzS899YR+3kuOL0g370p340sE86BZ2vY+vu1Br35WbwJClobFmQ70fRPcG?=
 =?us-ascii?Q?mqprV9111SVA+Rx/n0lG4zdUA+fAiqP/mQXl91LBquI5i44SMQQwceyOtYUd?=
 =?us-ascii?Q?o9p4i5SeAZG68MNEl2/yeHKFKajIWKnoHiox3b6+lJWoRA67MwqIDRaSIiVb?=
 =?us-ascii?Q?f7rCWJky6zkFS2HnWC11GfXPMxwRhDRe/Brsx1KrR4tiQlj6r0f9paTWkF/P?=
 =?us-ascii?Q?Mw=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 535490f1-8d37-400d-8278-08dc18862301
X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB8107.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jan 2024 00:32:37.3292
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ihovBYo71nvvcZMAdbYarqcF7giB26TJnPLYYu4Yq6s+uHDJtC/xNhU6wZ8XmJ8zpu+Pvqt1tzqfch1zRZY/W8iBMg+zVKE2vLm9BXyTXFo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR11MB4825
X-OriginatorOrg: intel.com

Robert Richter wrote:
> The last entry in the CDAT table may not mark the end of the CDAT
> table buffer specified by the length field in the CDAT header. It can
> be shorter with trailing unused (zero'ed) data. The actual table
> length is determined when reading all CDAT entries of the table with
> DOE.
> 
> If the table is greater than expected (containing zero'ed trailing
> data), the CDAT parser fails with:
> 
>  [   48.691717] Malformed DSMAS table length: (24:0)
>  [   48.702084] [CDAT:0x00] Invalid zero length
>  [   48.711460] cxl_port endpoint1: Failed to parse CDAT: -22
> 
> In addition, the table buffer size can be different from the size
> specified in the length field. This may cause out-of-bound access then
> parsing the CDAT table.
> 
> Fix that by providing an optonal buffer length argument to
> acpi_parse_entries_array() that can be used by cdat_table_parse() to
> propagate the buffer size down to its users.
> 
> Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> Cc: Len Brown <lenb@kernel.org>
> Signed-off-by: Robert Richter <rrichter@amd.com>
[..]
> diff --git a/lib/fw_table.c b/lib/fw_table.c
> index 1e5e0b2f7012..ddb67853b7ac 100644
> --- a/lib/fw_table.c
> +++ b/lib/fw_table.c
[..]
> @@ -164,8 +166,10 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
>  	int i;
>  
>  	type = acpi_get_subtable_type(id);
> -	table_end = (unsigned long)table_header +
> -		    acpi_table_get_length(type, table_header);
> +	table_len = acpi_table_get_length(type, table_header);
> +	if (max_length && max_length < table_len)
> +		table_len = max_length;

The other patches in this series look good, my only quibble here is
that this is an open-coded min_not_zero(). If nothing else pops up in
testing that triggers a v3 I will just fix that up locally.

Thanks, Robert!