]> git.ipfire.org Git - thirdparty/linux.git/commit
EFI/CPER: don't dump the entire memory region
authorMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 8 Jan 2026 11:35:06 +0000 (12:35 +0100)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Wed, 14 Jan 2026 16:04:42 +0000 (17:04 +0100)
commit55cc6fe5716f678f06bcb95140882dfa684464ec
tree7721303426a4b1a63bac0770829c10c7f995307b
parentfa2408a24f8f0db14d9cfc613ef162dc267d7ad4
EFI/CPER: don't dump the entire memory region

The current logic at cper_print_fw_err() doesn't check if the
error record length is big enough to handle offset. On a bad firmware,
if the ofset is above the actual record, length -= offset will
underflow, making it dump the entire memory.

The end result can be:

 - the logic taking a lot of time dumping large regions of memory;
 - data disclosure due to the memory dumps;
 - an OOPS, if it tries to dump an unmapped memory region.

Fix it by checking if the section length is too small before doing
a hex dump.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/firmware/efi/cper.c