On Thu, Aug 13, 2026 at 11:09:48PM +0800, Pengpeng Hou wrote: > NFIT parsing has several independent extent contracts: the outer table > must contain each advertised subtable, and variable or versioned records > must fit inside that subtable. The original patch mixed those contracts > and also derived the SPA structure length from the location-cookie-valid > flag. > > Split the checks by record type. Patch 1 validates the generic subtable > header and outer extent. Patch 2 accepts both defined SPA layouts while > treating the cookie flag as a validity bit, not a size selector. Patches > 3 and 4 validate the variable arrays and the control-region extent. > Patch 5 bounds the 32-bit capability mask without rejecting future > firmware that advertises a higher capability index. > > Changes since v1: > https://lore.kernel.org/all/[email protected]/
NAK See: Documentation/process/submitting-patches.rst Section "Respond to review comments" > - split the generic and type-specific contracts into separate patches > - handle both 56-byte and 64-byte SPA structures > - add the control-region extent check identified during review > - clamp the implemented capability mask instead of rejecting future bits > - describe the exact fields protected by each check > > The series was reviewed statically against the current tree. I did not > run an NFIT firmware fault-injection test. > > Pengpeng Hou (5): > ACPI: NFIT: validate subtable extents before dispatch > ACPI: NFIT: accept SPA structures with an unused location cookie > ACPI: NFIT: validate interleave and flush array extents > ACPI: NFIT: validate control region extent > ACPI: NFIT: bound the platform capability mask > > drivers/acpi/nfit/core.c | 77 ++++++++++++++++++++++++++++++++-------- > 1 file changed, 62 insertions(+), 15 deletions(-) > > base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a > > -- > 2.50.1 (Apple Git-155) >
