[PATCH] platform/x86/amd/pmf: check APTS buffer before reading header

[PATCH] platform/x86/amd/pmf: check APTS buffer before reading header

[Kang Chen]

apts_if_call_store_buffer() reads a u16 length from the APTS buffer
without checking that the buffer has at least two bytes.  The sibling
apmf_if_call_store_buffer() performs this check.  A Buffer(0) reply
from the APTS method makes the driver read two bytes past the ACPI
allocation.

Add the missing length check.

Fixes: 3eecb434d7f2 ("platform/x86/amd/pmf: Add support to get sps default APTS index values")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 drivers/platform/x86/amd/pmf/acpi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/platform/x86/amd/pmf/acpi.c b/drivers/platform/x86/amd/pmf/acpi.c
index 4392bf0bc0bf..8e0d9be8c042 100644
--- a/drivers/platform/x86/amd/pmf/acpi.c
+++ b/drivers/platform/x86/amd/pmf/acpi.c
@@ -137,6 +137,12 @@ int apts_if_call_store_buffer(struct amd_pmf_dev *pdev, u32 index, void *data, s
 		goto out;
 	}
 
+	if (info->buffer.length < sizeof(u16)) {
+		dev_err(pdev->dev, "buffer too small\n");
+		err = -EINVAL;
+		goto out;
+	}
+
 	size = *(u16 *)info->buffer.pointer;
 	if (info->buffer.length < size) {
 		dev_err(pdev->dev, "buffer smaller than header size %u < %zu\n",
-- 
2.34.1

Re: [PATCH] platform/x86/amd/pmf: check APTS buffer before reading header

[Mario Limonciello]

On 11/3/26 05:41, Kang Chen wrote:
> apts_if_call_store_buffer() reads a u16 length from the APTS buffer
> without checking that the buffer has at least two bytes.  The sibling
> apmf_if_call_store_buffer() performs this check.  A Buffer(0) reply
> from the APTS method makes the driver read two bytes past the ACPI
> allocation.
> 
> Add the missing length check.
> 
> Fixes: 3eecb434d7f2 ("platform/x86/amd/pmf: Add support to get sps default APTS index values")
> Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
> ---
>   drivers/platform/x86/amd/pmf/acpi.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/platform/x86/amd/pmf/acpi.c b/drivers/platform/x86/amd/pmf/acpi.c
> index 4392bf0bc0bf..8e0d9be8c042 100644
> --- a/drivers/platform/x86/amd/pmf/acpi.c
> +++ b/drivers/platform/x86/amd/pmf/acpi.c
> @@ -137,6 +137,12 @@ int apts_if_call_store_buffer(struct amd_pmf_dev *pdev, u32 index, void *data, s
>   		goto out;
>   	}
>   
> +	if (info->buffer.length < sizeof(u16)) {
> +		dev_err(pdev->dev, "buffer too small\n");
> +		err = -EINVAL;
> +		goto out;
> +	}
> +
>   	size = *(u16 *)info->buffer.pointer;
>   	if (info->buffer.length < size) {
>   		dev_err(pdev->dev, "buffer smaller than header size %u < %zu\n",

Thanks for the patch.  But I would say there is another on the mailing 
list that does very similar and covers more:

https://lore.kernel.org/platform-driver-x86/20261005072811.1378555-1-Shyam-sundar.S-k@amd.com/

It just needs to be rebased.