Re: [PATCH] ACPI: sysfs: Map only the requested range in acpi_data_show()

[Rafael J. Wysocki (Intel)]

On Tue, Oct 13, 2026 at 8:08 PM Jamie Nguyen <jamien@xxxxxxxxxx> wrote:
>
> acpi_data_show() maps the whole data region on every read(), although
> it copies at most count bytes and sysfs passes at most PAGE_SIZE bytes
> per call. acpi_os_unmap_iomem() defers the iounmap until after an RCU
> grace period, so a process reading one of these files in a loop keeps
> many full-size mappings in flight.
>
> Map only the range being read. acpi_os_map_iomem() rounds the mapping
> to page boundaries, so each mapping is now at most two pages, whatever
> the size of the region.
>
> A malformed table can describe a region that wraps around the end of
> the physical address space. acpi_os_map_iomem() doesn't check for that,
> and its lookup of existing mappings then matches an unrelated mapping,
> with or without this change. Fail reads of such a region before mapping
> anything.
>
> Assisted-by: LLM
> Signed-off-by: Jamie Nguyen <jamien@xxxxxxxxxx>
> ---
> As discussed on the BDAT v2 thread:
> https://lore.kernel.org/r/CAJZ5v0ixQ_5jmrfm4mz50tZtCEq6nJt1b2eMoBdhr0f3AY+k7w@xxxxxxxxxxxxxx
>
> This doesn't depend on that series and applies on its own.
>
> Tested on an arm64 server with 4K and 64K pages, with the BDAT v2
> series applied:
>
> - The BERT and BDAT data files match /dev/mem when read whole, byte by
>   byte, page by page, and across page boundaries.
> - Each read maps at most two pages. With 4K pages, looping full reads
>   of the 90754-byte BDAT file kept at most 167 MiB of vmalloc space
>   mapped (1740 MiB before), and looping 1-byte reads at most 355 MiB
>   (3090 MiB before).
> - Malformed BERT tables loaded via initrd table upgrade, with regions
>   that wrap around the end of the physical address space, fail every
>   read with -EINVAL.
>
>  drivers/acpi/sysfs.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
> index dd4a99f09efea65..138009659a7b55f 100644
> --- a/drivers/acpi/sysfs.c
> +++ b/drivers/acpi/sysfs.c
> @@ -419,6 +419,7 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj,
>         struct acpi_data_attr *data_attr;
>         void __iomem *base;
>         ssize_t size;
> +       u64 end;
>
>         data_attr = container_of(bin_attr, struct acpi_data_attr, attr);
>         size = data_attr->attr.size;
> @@ -432,13 +433,17 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj,
>         if (count > size - offset)
>                 count = size - offset;
>
> -       base = acpi_os_map_iomem(data_attr->addr, size);
> +       /* acpi_os_map_iomem() can't handle a range that wraps around */
> +       if (check_add_overflow(data_attr->addr, size, &end))
> +               return -EINVAL;
> +
> +       base = acpi_os_map_iomem(data_attr->addr + offset, count);
>         if (!base)
>                 return -ENOMEM;
>
> -       memcpy_fromio(buf, base + offset, count);
> +       memcpy_fromio(buf, base, count);
>
> -       acpi_os_unmap_iomem(base, size);
> +       acpi_os_unmap_iomem(base, count);
>
>         return count;
>  }
> --

Applied as 7.4-rc material, thanks!