Interleave and flush subtables carry a fixed header followed by arrays
whose element counts come from firmware. sizeof_idt() and sizeof_flush()
derive the copy size from those counts but do not require the result to
fit in the subtable's advertised length.
A short subtable with a large line_count or hint_count can consequently
make add_idt() or add_flush() copy beyond the subtable. The outer NFIT
extent check cannot catch this because the following subtable bytes are
still inside the enclosing ACPI table.
Use struct_size() for both variable arrays and reject a derived size that
exceeds the current subtable.
Fixes: b94d5230d06e ("libnvdimm, nfit: initial libnvdimm infrastructure and
NFIT support")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <[email protected]>
---
drivers/acpi/nfit/core.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index f68edfe64952..bf4ddc56494e 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -882,9 +882,16 @@ static bool add_bdw(struct acpi_nfit_desc *acpi_desc,
static size_t sizeof_idt(struct acpi_nfit_interleave *idt)
{
+ size_t size;
+
if (idt->header.length < sizeof(*idt))
return 0;
- return sizeof(*idt) + sizeof(u32) * idt->line_count;
+
+ size = struct_size(idt, line_offset, idt->line_count);
+ if (size > idt->header.length)
+ return 0;
+
+ return size;
}
static bool add_idt(struct acpi_nfit_desc *acpi_desc,
@@ -921,9 +928,16 @@ static bool add_idt(struct acpi_nfit_desc *acpi_desc,
static size_t sizeof_flush(struct acpi_nfit_flush_address *flush)
{
+ size_t size;
+
if (flush->header.length < sizeof(*flush))
return 0;
- return struct_size(flush, hint_address, flush->hint_count);
+
+ size = struct_size(flush, hint_address, flush->hint_count);
+ if (size > flush->header.length)
+ return 0;
+
+ return size;
}
static bool add_flush(struct acpi_nfit_desc *acpi_desc,
--
2.50.1 (Apple Git-155)
