[PATCH] ACPI: APEI: validate ERST record length

[Laxman Acharya Padhya]

erst_read() returns the advertised record length without copying when the
caller's buffer is too small. erst_read_record() only rejects records
shorter than the expected header before inspecting the creator ID.

An oversized record can therefore leave stale or uninitialized data in
the destination. If that data matches the requested creator, a caller
may use the oversized length and read beyond its temporary buffer.

Reject record lengths outside the supplied buffer before inspecting the
record contents.

Fixes: f6f828513290 ("pstore: pass allocated memory region back to caller")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>
---
 drivers/acpi/apei/erst.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index bf65e3461531..2fefef65d674 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -936,10 +936,10 @@ ssize_t erst_read_record(u64 record_id, struct cper_record_header *record,
 		goto out;
 
 	/*
-	 * if erst_read return value is less than record head length,
-	 * consider it as -EIO, and clear the record_id cache.
+	 * If the record length is outside the supplied buffer, consider it
+	 * invalid and clear it from the record ID cache.
 	 */
-	if (len < recordlen) {
+	if (len < recordlen || len > buflen) {
 		len = -EIO;
 		erst_clear_cache(record_id);
 		goto out;
-- 
2.51.2