In the Linux kernel, the following vulnerability has been resolved:

cxl: Fix CXL HEADERLOG SIZE to match RAS Capability size

The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes (CXL RAS CAPABILITY LENGTH); the Header Log occupies the trailing 64 bytes at offset 0x18. CXL HEADERLOG SIZE was defined as SZ 512, eight times the actual on-device size.

header log copy() reads CXL HEADERLOG SIZE U32 (128) dwords from the RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. The cxl aer uncorrectable error trace event memcpy()s CXL HEADERLOG SIZE (512) bytes from its source. For the CPER caller the source is struct cxl ras capability regs::header log[16] (64 bytes) embedded in a stack-local cxl cper prot err work data, so the memcpy reads 448 bytes of kernel stack into the trace event ring buffer where userspace can read it via tracefs.

Set CXL HEADERLOG SIZE to 64 and derive CXL HEADERLOG SIZE U32 from it, bringing all iomap readers into agreement on 16 dwords. Userspace tools such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) header log layout in the cxl aer uncorrectable error trace event. Add CXL HEADERLOG TRACE SIZE U32 = 128 and use it for the trace event array and its memcpy to preserve that ABI. Both callers now pass a zero-filled u32[CXL HEADERLOG TRACE SIZE U32] staging buffer with only the first CXL HEADERLOG SIZE U32 (16) entries populated from hardware; the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring buffer layout intact.

[ dj: Replaced 64 with SZ 64 per RichardC ]