On Mon, Apr 27, 2026 at 01:03:34PM +0100, Kevin Brodsky wrote:
> get_header() wants the size of the reserved area in struct
> sigcontext, but instead we pass it the size of the entire struct.
> This could in theory result in an out-of-bounds read (if the signal
> frame is malformed).

> Fix this using one of the existing macros from
> tools/testing/selftests/arm64/signal/testcases/testcases.h.

Oh, good to know this is peering inside the arm64 selftests - it'd be
good to document that on the arm64 side to avoid unpleasant suprirses.

>  {
>  	struct _aarch64_ctx *ctx = GET_UC_RESV_HEAD(uctxt);
> +	size_t resv_size = GET_UCP_RESV_SIZE(uctxt);
>  	struct poe_context *poe_ctx =
>  		(struct poe_context *) get_header(ctx, POE_MAGIC,
> -						sizeof(uctxt->uc_mcontext), NULL);
> +						  resv_size, NULL);

Reviewed-by: Mark Brown <broonie@kernel.org>