Re: [PATCH v2 0/5] ACPI: NFIT: harden subtable extent validation

[Alison Schofield]

On Thu, Aug 13, 2026 at 11:09:48PM +0800, Pengpeng Hou wrote:
> NFIT parsing has several independent extent contracts: the outer table
> must contain each advertised subtable, and variable or versioned records
> must fit inside that subtable.  The original patch mixed those contracts
> and also derived the SPA structure length from the location-cookie-valid
> flag.
> 
> Split the checks by record type.  Patch 1 validates the generic subtable
> header and outer extent.  Patch 2 accepts both defined SPA layouts while
> treating the cookie flag as a validity bit, not a size selector.  Patches
> 3 and 4 validate the variable arrays and the control-region extent.
> Patch 5 bounds the 32-bit capability mask without rejecting future
> firmware that advertises a higher capability index.
> 
> Changes since v1:
> https://lore.kernel.org/all/20260722041701.21078-1-pengpeng@xxxxxxxxxxx/

NAK
See: Documentation/process/submitting-patches.rst 
Section "Respond to review comments"


> - split the generic and type-specific contracts into separate patches
> - handle both 56-byte and 64-byte SPA structures
> - add the control-region extent check identified during review
> - clamp the implemented capability mask instead of rejecting future bits
> - describe the exact fields protected by each check
> 
> The series was reviewed statically against the current tree. I did not
> run an NFIT firmware fault-injection test.
> 
> Pengpeng Hou (5):
>   ACPI: NFIT: validate subtable extents before dispatch
>   ACPI: NFIT: accept SPA structures with an unused location cookie
>   ACPI: NFIT: validate interleave and flush array extents
>   ACPI: NFIT: validate control region extent
>   ACPI: NFIT: bound the platform capability mask
> 
>  drivers/acpi/nfit/core.c | 77 ++++++++++++++++++++++++++++++++--------
>  1 file changed, 62 insertions(+), 15 deletions(-)
> 
> base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
> 
> -- 
> 2.50.1 (Apple Git-155)
>