NFIT parsing has several independent extent contracts: the outer table must contain each advertised subtable, and variable or versioned records must fit inside that subtable. The original patch mixed those contracts and also derived the SPA structure length from the location-cookie-valid flag.
Split the checks by record type. Patch 1 validates the generic subtable header and outer extent. Patch 2 accepts both defined SPA layouts while treating the cookie flag as a validity bit, not a size selector. Patches 3 and 4 validate the variable arrays and the control-region extent. Patch 5 bounds the 32-bit capability mask without rejecting future firmware that advertises a higher capability index. Changes since v1: https://lore.kernel.org/all/[email protected]/ - split the generic and type-specific contracts into separate patches - handle both 56-byte and 64-byte SPA structures - add the control-region extent check identified during review - clamp the implemented capability mask instead of rejecting future bits - describe the exact fields protected by each check The series was reviewed statically against the current tree. I did not run an NFIT firmware fault-injection test. Pengpeng Hou (5): ACPI: NFIT: validate subtable extents before dispatch ACPI: NFIT: accept SPA structures with an unused location cookie ACPI: NFIT: validate interleave and flush array extents ACPI: NFIT: validate control region extent ACPI: NFIT: bound the platform capability mask drivers/acpi/nfit/core.c | 77 ++++++++++++++++++++++++++++++++-------- 1 file changed, 62 insertions(+), 15 deletions(-) base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a -- 2.50.1 (Apple Git-155)
