kernel/git/next/linux-next.git/drivers/acpi, branch master

Merge branch 'acpi-apei' (early part) into linux-next

2026-09-09T17:06:27+00:00

* 'acpi-apei' (early part): cxl/ras: Make cxl_cper_handle_prot_err() static ACPI: APEI: GHES: Bound AER info copy and sanitize software metadata ACPI: APEI: GHES: Validate memory error section length before payload access efi/cper: Read only validated fields in cper_mem_err_pack() ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length ACPI: extlog: Fix CONFIG_ACPI_APEI_PCIEAER guard typo ACPI: extlog: Validate PCIe error section length before payload access ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer ACPI: extlog: Defer CXL protocol error handling to avoid lock inversion ACPI: extlog: Validate elog record length before walking sections efi/cper: Reject an error status block length that wraps a u32 efi/cper: Reject CPER records with an out-of-range error_data_length

treewide: refresh kmalloc_obj() conversions

2026-09-05T04:37:00+00:00

This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook

ACPI: APEI: GHES: Bound AER info copy and sanitize software metadata

2026-09-04T18:22:06+00:00

ghes_handle_aer() copies sizeof(struct aer_capability_regs) out of the fixed 96-byte pcie_err->aer_info. The struct is larger, so the copy reads past the section, and it fills the software-only header_len and flit fields of the embedded struct pcie_tlp_log from firmware bytes. pcie_print_tlp_log() uses both to bound a loop over dw[], so a large value walks past the array. Nothing checks the section can hold a struct cper_sec_pcie either. Validate error_data_length, zero the destination, and map aer_info onto the struct as extlog_print_pcie() does: copy up to the four Header Log DWORDs, then place the TLP Prefix Log from its own offset. The rest stays zero, covering header_len and flit. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=3 Fixes: 7e077e6707b3 ("PCI/ERR: Handle TLP Log in Flit mode") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-13-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: APEI: GHES: Validate memory error section length before payload access

2026-09-04T18:22:06+00:00

ghes_do_proc() hands the CPER_SEC_PLATFORM_MEM payload to the report chain, arch_apei_report_mem_error() and ghes_handle_memory_failure() without checking gdata->error_data_length. All three read validation_bits and physical_addr, at offsets 0 and 16, so a shorter section reads past the record. Check the length once in ghes_do_proc(), before any consumer runs. Take the 73-byte struct cper_sec_mem_err_old as the floor: older firmware legitimately emits that UEFI 2.1/2.2 layout, and it makes validation_bits safe to read. The fields from "extended" on are absent from that layout, so also require whatever length the validation bits claim. Derive it per field rather than demanding the full 80 bytes: rank needs only 76, and the BANK_GROUP and BANK_ADDRESS bits describe "bank" at offset 38, which every record carries. Testing the whole mask against one size, as cper_print_mem() does, gets it wrong both ways. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=7 Fixes: ca104edc1784 ("ACPI, APEI, GHES: Cleanup ghes memory error handling") Reviewed-by: Hanjun Guo Reviewed-by: Shuai Xue Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-12-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy

2026-09-04T18:22:05+00:00

cxl_cper_setup_prot_err_work_data() locates the RAS Capability block at prot_err + sizeof(*prot_err) + dvsec_len and copies it, but dvsec_len is firmware controlled and never validated, so it can point the copy outside the section. Extend cxl_cper_sec_prot_err_valid() to check that the section can hold the header, and that the header, DVSEC and RAS Capability block together fit the reported section length. Reported-by: sashiko-bot@kernel.org Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6 Link: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/ Fixes: 315c2f0b53ba ("acpi/ghes, cper: Recognize and cache CXL Protocol errors") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Ben Cheatham Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-10-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length

2026-09-04T18:22:05+00:00

cxl_cper_post_event() copies a fixed sizeof(struct cxl_cper_event_rec) out of the firmware CPER section without checking how long the section actually is, so a short one reads past the record. Pass gdata->error_data_length in and reject a section too small to hold the record before the copy. Reported-by: sashiko-bot@kernel.org Link: https://sashiko.dev/#/patchset/20260617-topics-ahmtib01-ras_ffh_arm_internal_review-v6-0-91f725174aa0@arm.com?part=6 Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-9-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: extlog: Fix CONFIG_ACPI_APEI_PCIEAER guard typo

2026-09-04T18:22:05+00:00

The guard reads "#ifdef ACPI_APEI_PCIEAER" rather than "#ifdef CONFIG_ACPI_APEI_PCIEAER". That symbol is never defined, so the extlog PCIe AER handling is always compiled out. Use the CONFIG_ prefixed symbol. Fixes: e778ffefa34d ("ACPI: extlog: Trace CPER PCI Express Error Section") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Ben Cheatham Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-8-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: extlog: Validate PCIe error section length before payload access

2026-09-04T18:22:05+00:00

extlog_print_pcie() reads pcie_err->validation_bits and device_id and copies the 96-byte aer_info buffer without checking that gdata->error_data_length is big enough for a struct cper_sec_pcie. The cper_estatus_check() call added earlier keeps the read inside the estatus block, but a short section still gets stale adjacent bytes treated as PCIe error data. Reject a section too small to hold the record before touching any field, and warn: a truncated section means firmware is emitting malformed records. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/ Fixes: e778ffefa34d ("ACPI: extlog: Trace CPER PCI Express Error Section") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-7-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer

2026-09-04T18:22:05+00:00

extlog_print_pcie() casts pcie_err->aer_info straight to struct aer_capability_regs *. That struct embeds struct pcie_tlp_log, whose software-only header_len and flit fields sit at offset 84 - inside the 96-byte aer_info buffer - so the cast fills them with raw firmware bytes. pcie_print_tlp_log() uses both to bound a loop over dw[], and a large header_len walks past the end of the array. Copy into a zeroed local struct, and only as far as aer_info maps onto it: the leading registers and the four Header Log DWORDs. Place the TLP Prefix Log separately, from the offset the hardware keeps it at. The rest stays zero, which covers header_len and flit and keeps the Root Error registers out of the prefix log, where pcie_print_tlp_log() would print them as end-to-end prefixes. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/ Fixes: e778ffefa34d ("ACPI: extlog: Trace CPER PCI Express Error Section") Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-6-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki

ACPI: extlog: Defer CXL protocol error handling to avoid lock inversion

2026-09-04T18:22:04+00:00

extlog_print() calls cxl_cper_handle_prot_err() synchronously while the MCE notifier chain rwsem is held, and that path takes the PCI device_lock via guard(device)(). The probe path takes the two in the opposite order, holding device_lock while mce_register_decode_chain() takes the rwsem, so they can deadlock AB-BA. ghes.c already avoids this by posting protocol errors to a kfifo and handling them from a workqueue via cxl_cper_post_prot_err(). Export that function and call it instead. Declare it with the other CONFIG_ACPI_APEI_GHES exports rather than at the end of the header. No #else stub: ACPI_EXTLOG selects ACPI_APEI_GHES, so the only caller cannot exist without it. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/ Reviewed-by: Alison Schofield Reviewed-by: Shuai Xue Reviewed-by: Jonathan Cameron Reviewed-by: Hanjun Guo Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-5-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki