Re:[PATCH] lib/firmware_table: validate subtable bounds

[jiale yao]

At 2026-10-16 22:41:54, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>The generic firmware table walker dispatches matching entries after only
>checking that a generic subtable header is present. A record whose
>declared length is shorter than its header or extends past the table can
>therefore reach a handler before its bounds have been established.
>
>Validate the complete generic header and the declared record range
>before looking up or invoking a handler. This also rejects zero-length
>records and prevents malformed lengths from advancing the cursor outside
>the table.
>

Fixes: 60574d1e05b0 ("acpi: Create subtable parsing infrastructure")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> lib/fw_table.c | 25 ++++++++++++++-----------
> 1 file changed, 14 insertions(+), 11 deletions(-)
>
>diff --git a/lib/fw_table.c b/lib/fw_table.c
>index 16291814450e..84c2515edde7 100644
>--- a/lib/fw_table.c
>+++ b/lib/fw_table.c
>@@ -172,7 +172,20 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
> 	    ((unsigned long)table_header + table_size);
> 	subtable_len = acpi_get_subtable_header_length(&entry);
> 
>-	while (((unsigned long)entry.hdr) + subtable_len < table_end) {
>+	while ((unsigned long)entry.hdr < table_end) {
>+		if (table_end - (unsigned long)entry.hdr < subtable_len) {
>+			pr_err("[%4.4s] Invalid subtable header\n", id);
>+			return -EINVAL;
>+		}
>+
>+		entry_len = acpi_get_entry_length(&entry);
>+		if (entry_len < subtable_len ||
>+		    entry_len > table_end - (unsigned long)entry.hdr) {
>+			pr_err("[%4.4s:0x%02lx] Invalid length %lu\n", id,
>+			       acpi_get_entry_type(&entry), entry_len);
>+			return -EINVAL;
>+		}
>+
> 		for (i = 0; i < proc_num; i++) {
> 			if (acpi_get_entry_type(&entry) != proc[i].id)
> 				continue;
>@@ -186,16 +199,6 @@ acpi_parse_entries_array(char *id, unsigned long table_size,
> 			break;
> 		}
> 
>-		/*
>-		 * If entry->length is 0, break from this loop to avoid
>-		 * infinite loop.
>-		 */
>-		entry_len = acpi_get_entry_length(&entry);
>-		if (entry_len == 0) {
>-			pr_err("[%4.4s:0x%02x] Invalid zero length\n", id, proc->id);
>-			return -EINVAL;
>-		}
>-
> 		entry.hdr = (union acpi_subtable_headers *)
> 		    ((unsigned long)entry.hdr + entry_len);
> 	}
>-- 
>2.34.1