[PATCH] ACPI: APEI: reject ERST records beyond the address range

[Laxman Acharya Padhya]

ERST reads CPER records from the firmware-provided Error Log Address
Range. __erst_read() uses the CPER record_length field to tell callers
whether their buffer is large enough, but it does not first check whether
that length fits in the mapped ERST range.

Reject records whose reported length extends beyond the ERST range before
returning the length to callers. This prevents malformed persistent
storage from making later pstore reads allocate and copy using a length
that was never backed by the ERST buffer.

Fixes: f6f828513290 ("pstore: pass allocated memory region back to caller")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>
---
 drivers/acpi/apei/erst.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index bf65e3461..2ebe212a5 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -862,6 +862,8 @@ static ssize_t __erst_read(u64 record_id, struct cper_record_header *record,
 		return rc;
 	rcd_tmp = erst_erange.vaddr + offset;
 	len = rcd_tmp->record_length;
+	if (offset > erst_erange.size || len > erst_erange.size - offset)
+		return -EIO;
 	if (len <= buflen)
 		memcpy(record, rcd_tmp, len);
 

base-commit: 62cc90241548d5570ee68e01aaba6506964e9811
-- 
2.51.2