[PATCH v2 0/5] ACPI: NFIT: harden subtable extent validation

[Pengpeng Hou]

NFIT parsing has several independent extent contracts: the outer table
must contain each advertised subtable, and variable or versioned records
must fit inside that subtable.  The original patch mixed those contracts
and also derived the SPA structure length from the location-cookie-valid
flag.

Split the checks by record type.  Patch 1 validates the generic subtable
header and outer extent.  Patch 2 accepts both defined SPA layouts while
treating the cookie flag as a validity bit, not a size selector.  Patches
3 and 4 validate the variable arrays and the control-region extent.
Patch 5 bounds the 32-bit capability mask without rejecting future
firmware that advertises a higher capability index.

Changes since v1:
https://lore.kernel.org/all/20260722041701.21078-1-pengpeng@xxxxxxxxxxx/
- split the generic and type-specific contracts into separate patches
- handle both 56-byte and 64-byte SPA structures
- add the control-region extent check identified during review
- clamp the implemented capability mask instead of rejecting future bits
- describe the exact fields protected by each check

The series was reviewed statically against the current tree. I did not
run an NFIT firmware fault-injection test.

Pengpeng Hou (5):
  ACPI: NFIT: validate subtable extents before dispatch
  ACPI: NFIT: accept SPA structures with an unused location cookie
  ACPI: NFIT: validate interleave and flush array extents
  ACPI: NFIT: validate control region extent
  ACPI: NFIT: bound the platform capability mask

 drivers/acpi/nfit/core.c | 77 ++++++++++++++++++++++++++++++++--------
 1 file changed, 62 insertions(+), 15 deletions(-)

base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a

-- 
2.50.1 (Apple Git-155)