[PATCH v3 0/3] RAS: Fix ARM processor error bounds checking

[PATCH v3 0/3] RAS: Fix ARM processor error bounds checking

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") and commit 05954511b73e ("RAS: Report all ARM
processor CPER information to userspace") introduced bounds checking
for malformed ARM processor error records in log_arm_hw_error().
However, three issues remain:

1. The ctx_info bounds check condition is inverted: it adds
   ctx_info->size when the context header is already past the end of
   the section instead of when it is within bounds.

2. When vsei_len < 0, the error path does not verify pei_len and
   ctx_len. Since these are derived from err_info_num and
   context_info_num, they may describe regions beyond the allocated
   record, causing trace_arm_event() to read out of bounds.

3. ctx_info->size is a u32 taken directly from the firmware-generated
   record. A value over 0x7fffffff overflows the signed int sz used
   to advance ctx_info, so the iteration can walk past the end of the
   section.

Patch 1 fixes the inverted bounds check for context info iteration.
Patch 2 sanitizes pei_len/ctx_len/ven_err_data in the vsei_len < 0
error path to prevent out-of-bounds reads in trace_arm_event().
Patch 3 checks each context entry with 64-bit arithmetic so that both
the header and the context data fit in the section, and stops the walk
at the first entry that does not fit, so a malformed size cannot
overflow sz and walk ctx_info out of the section.

Changes in v3:
  - Remove the empty line between the Fixes: and Signed-off-by: tags
    in patches 1 and 2, per Hanjun Guo's comments.
  - Add braces around the else branch that assigns ven_err_data in
    patch 2, as suggested by Hanjun Guo.
  - Add new patch 3 to check each context entry with 64-bit
    arithmetic and stop the walk at the first entry that does not fit
    in the section, so a ctx_info->size over 0x7fffffff cannot
    overflow the signed int sz and walk ctx_info past the section,
    addressing Hanjun Guo's overflow comment.

Changes in v2:
  - Split the original single patch into two separate patches, one
    for each distinct fix, to ease review and backporting.

v2:
  RAS: Fix ARM processor error bounds checking
  https://lore.kernel.org/all/20260825134323.4181892-1-liuwenliang@huawei.com/

v1:
  RAS: Fix out-of-range section_length in ARM processor error handling
  https://lore.kernel.org/all/20260820131829.1006371-1-liuwenliang@huawei.com/

Abbott Liu (3):
  RAS: Fix inverted context info bounds check in ARM processor errors
  RAS: Fix out-of-bounds read when tracing arm_event
  RAS: Fix integer overflow in ARM processor error context walk

 drivers/ras/ras.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

-- 
2.43.0

Re: [PATCH v3 0/3] RAS: Fix ARM processor error bounds checking

[Abbott Liu]

Sorry to bother you, but this email was sent by mistake. Please ignore it.

> Subject: [PATCH v3 0/3] RAS: Fix ARM processor error bounds checking
> Date: Tue, 8 Sep 2026 21:08:15 +0800	[thread overview]
> Message-ID: <20260906130000.4181892-1-liuwenliang@huawei.com> (raw)
> 
> Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
> allocated memory") and commit 05954511b73e ("RAS: Report all ARM
> processor CPER information to userspace") introduced bounds checking
> for malformed ARM processor error records in log_arm_hw_error().
> However, three issues remain:
> 
> 1. The ctx_info bounds check condition is inverted: it adds
>    ctx_info->size when the context header is already past the end of
>    the section instead of when it is within bounds.
> 
> 2. When vsei_len < 0, the error path does not verify pei_len and
>    ctx_len. Since these are derived from err_info_num and
>    context_info_num, they may describe regions beyond the allocated
>    record, causing trace_arm_event() to read out of bounds.
> 
> 3. ctx_info->size is a u32 taken directly from the firmware-generated
>    record. A value over 0x7fffffff overflows the signed int sz used
>    to advance ctx_info, so the iteration can walk past the end of the
>    section.
> 
> Patch 1 fixes the inverted bounds check for context info iteration.
> Patch 2 sanitizes pei_len/ctx_len/ven_err_data in the vsei_len < 0
> error path to prevent out-of-bounds reads in trace_arm_event().
> Patch 3 checks each context entry with 64-bit arithmetic so that both
> the header and the context data fit in the section, and stops the walk
> at the first entry that does not fit, so a malformed size cannot
> overflow sz and walk ctx_info out of the section.
> 
> Changes in v3:
>   - Remove the empty line between the Fixes: and Signed-off-by: tags
>     in patches 1 and 2, per Hanjun Guo's comments.
>   - Add braces around the else branch that assigns ven_err_data in
>     patch 2, as suggested by Hanjun Guo.
>   - Add new patch 3 to check each context entry with 64-bit
>     arithmetic and stop the walk at the first entry that does not fit
>     in the section, so a ctx_info->size over 0x7fffffff cannot
>     overflow the signed int sz and walk ctx_info past the section,
>     addressing Hanjun Guo's overflow comment.
> 
> Changes in v2:
>   - Split the original single patch into two separate patches, one
>     for each distinct fix, to ease review and backporting.
> 
> v2:
>   RAS: Fix ARM processor error bounds checking
>   https://lore.kernel.org/all/20260825134323.4181892-1-liuwenliang@huawei.com/
> 
> v1:
>   RAS: Fix out-of-range section_length in ARM processor error handling
>   https://lore.kernel.org/all/20260820131829.1006371-1-liuwenliang@huawei.com/
> 
> Abbott Liu (3):
>   RAS: Fix inverted context info bounds check in ARM processor errors
>   RAS: Fix out-of-bounds read when tracing arm_event
>   RAS: Fix integer overflow in ARM processor error context walk
> 
>  drivers/ras/ras.c | 33 +++++++++++++++++++++++++++------
>  1 file changed, 27 insertions(+), 6 deletions(-)