* [PATCH] lib/firmware_table: validate subtable bounds
@ 2026-10-16 14:41 Jiale Yao
2026-10-16 23:15 ` Andrew Morton
2026-10-17 7:35 ` jiale yao
0 siblings, 2 replies; 3+ messages in thread
From: Jiale Yao @ 2026-10-16 14:41 UTC (permalink / raw)
To: Andrew Morton, Rafael J. Wysocki, Len Brown, linux-kernel, linux-acpi
Cc: Jiale Yao
The generic firmware table walker dispatches matching entries after only
checking that a generic subtable header is present. A record whose
declared length is shorter than its header or extends past the table can
therefore reach a handler before its bounds have been established.
Validate the complete generic header and the declared record range
before looking up or invoking a handler. This also rejects zero-length
records and prevents malformed lengths from advancing the cursor outside
the table.
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
lib/fw_table.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/lib/fw_table.c b/lib/fw_table.c
index 16291814450e..84c2515edde7 100644
--- a/lib/fw_table.c
+++ b/lib/fw_table.c
@@ -172,7 +172,20 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
((unsigned long)table_header + table_size);
subtable_len = acpi_get_subtable_header_length(&entry);
- while (((unsigned long)entry.hdr) + subtable_len < table_end) {
+ while ((unsigned long)entry.hdr < table_end) {
+ if (table_end - (unsigned long)entry.hdr < subtable_len) {
+ pr_err("[%4.4s] Invalid subtable header\n", id);
+ return -EINVAL;
+ }
+
+ entry_len = acpi_get_entry_length(&entry);
+ if (entry_len < subtable_len ||
+ entry_len > table_end - (unsigned long)entry.hdr) {
+ pr_err("[%4.4s:0x%02lx] Invalid length %lu\n", id,
+ acpi_get_entry_type(&entry), entry_len);
+ return -EINVAL;
+ }
+
for (i = 0; i < proc_num; i++) {
if (acpi_get_entry_type(&entry) != proc[i].id)
continue;
@@ -186,16 +199,6 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
break;
}
- /*
- * If entry->length is 0, break from this loop to avoid
- * infinite loop.
- */
- entry_len = acpi_get_entry_length(&entry);
- if (entry_len == 0) {
- pr_err("[%4.4s:0x%02x] Invalid zero length\n", id, proc->id);
- return -EINVAL;
- }
-
entry.hdr = (union acpi_subtable_headers *)
((unsigned long)entry.hdr + entry_len);
}
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] lib/firmware_table: validate subtable bounds
2026-10-16 14:41 [PATCH] lib/firmware_table: validate subtable bounds Jiale Yao
@ 2026-10-16 23:15 ` Andrew Morton
2026-10-17 7:35 ` jiale yao
1 sibling, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-10-16 23:15 UTC (permalink / raw)
To: Jiale Yao
Cc: Rafael J. Wysocki, Len Brown, linux-kernel, linux-acpi, Dave Jiang
On Fri, 16 Oct 2026 22:41:54 +0800 Jiale Yao <yaojiale02@163.com> wrote:
> The generic firmware table walker dispatches matching entries after only
> checking that a generic subtable header is present. A record whose
> declared length is shorter than its header or extends past the table can
> therefore reach a handler before its bounds have been established.
>
> Validate the complete generic header and the declared record range
> before looking up or invoking a handler. This also rejects zero-length
> records and prevents malformed lengths from advancing the cursor outside
> the table.
Thanks.
get_maintainer is quite unreliable with lib/ files. Please always use
git-blame when determining who should be cc'ed.
Dave, can you please take a look?
> --- a/lib/fw_table.c
> +++ b/lib/fw_table.c
> @@ -172,7 +172,20 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
> ((unsigned long)table_header + table_size);
> subtable_len = acpi_get_subtable_header_length(&entry);
>
> - while (((unsigned long)entry.hdr) + subtable_len < table_end) {
> + while ((unsigned long)entry.hdr < table_end) {
> + if (table_end - (unsigned long)entry.hdr < subtable_len) {
> + pr_err("[%4.4s] Invalid subtable header\n", id);
> + return -EINVAL;
> + }
> +
> + entry_len = acpi_get_entry_length(&entry);
> + if (entry_len < subtable_len ||
> + entry_len > table_end - (unsigned long)entry.hdr) {
> + pr_err("[%4.4s:0x%02lx] Invalid length %lu\n", id,
> + acpi_get_entry_type(&entry), entry_len);
> + return -EINVAL;
> + }
> +
> for (i = 0; i < proc_num; i++) {
> if (acpi_get_entry_type(&entry) != proc[i].id)
> continue;
> @@ -186,16 +199,6 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
> break;
> }
>
> - /*
> - * If entry->length is 0, break from this loop to avoid
> - * infinite loop.
> - */
> - entry_len = acpi_get_entry_length(&entry);
> - if (entry_len == 0) {
> - pr_err("[%4.4s:0x%02x] Invalid zero length\n", id, proc->id);
> - return -EINVAL;
> - }
> -
> entry.hdr = (union acpi_subtable_headers *)
> ((unsigned long)entry.hdr + entry_len);
> }
> --
> 2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re:[PATCH] lib/firmware_table: validate subtable bounds
2026-10-16 14:41 [PATCH] lib/firmware_table: validate subtable bounds Jiale Yao
2026-10-16 23:15 ` Andrew Morton
@ 2026-10-17 7:35 ` jiale yao
1 sibling, 0 replies; 3+ messages in thread
From: jiale yao @ 2026-10-17 7:35 UTC (permalink / raw)
To: Andrew Morton, Rafael J. Wysocki, Len Brown, linux-kernel, linux-acpi
At 2026-10-16 22:41:54, "Jiale Yao" <yaojiale02@163.com> wrote:
>The generic firmware table walker dispatches matching entries after only
>checking that a generic subtable header is present. A record whose
>declared length is shorter than its header or extends past the table can
>therefore reach a handler before its bounds have been established.
>
>Validate the complete generic header and the declared record range
>before looking up or invoking a handler. This also rejects zero-length
>records and prevents malformed lengths from advancing the cursor outside
>the table.
>
Fixes: 60574d1e05b0 ("acpi: Create subtable parsing infrastructure")
>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> lib/fw_table.c | 25 ++++++++++++++-----------
> 1 file changed, 14 insertions(+), 11 deletions(-)
>
>diff --git a/lib/fw_table.c b/lib/fw_table.c
>index 16291814450e..84c2515edde7 100644
>--- a/lib/fw_table.c
>+++ b/lib/fw_table.c
>@@ -172,7 +172,20 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
> ((unsigned long)table_header + table_size);
> subtable_len = acpi_get_subtable_header_length(&entry);
>
>- while (((unsigned long)entry.hdr) + subtable_len < table_end) {
>+ while ((unsigned long)entry.hdr < table_end) {
>+ if (table_end - (unsigned long)entry.hdr < subtable_len) {
>+ pr_err("[%4.4s] Invalid subtable header\n", id);
>+ return -EINVAL;
>+ }
>+
>+ entry_len = acpi_get_entry_length(&entry);
>+ if (entry_len < subtable_len ||
>+ entry_len > table_end - (unsigned long)entry.hdr) {
>+ pr_err("[%4.4s:0x%02lx] Invalid length %lu\n", id,
>+ acpi_get_entry_type(&entry), entry_len);
>+ return -EINVAL;
>+ }
>+
> for (i = 0; i < proc_num; i++) {
> if (acpi_get_entry_type(&entry) != proc[i].id)
> continue;
>@@ -186,16 +199,6 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
> break;
> }
>
>- /*
>- * If entry->length is 0, break from this loop to avoid
>- * infinite loop.
>- */
>- entry_len = acpi_get_entry_length(&entry);
>- if (entry_len == 0) {
>- pr_err("[%4.4s:0x%02x] Invalid zero length\n", id, proc->id);
>- return -EINVAL;
>- }
>-
> entry.hdr = (union acpi_subtable_headers *)
> ((unsigned long)entry.hdr + entry_len);
> }
>--
>2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-17 7:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-16 14:41 [PATCH] lib/firmware_table: validate subtable bounds Jiale Yao
2026-10-16 23:15 ` Andrew Morton
2026-10-17 7:35 ` jiale yao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®