* [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event
2026-08-25 13:43 [PATCH v2 0/2] RAS: Fix ARM processor error bounds checking Abbott Liu
@ 2026-08-25 13:43 ` Abbott Liu
2026-09-03 9:56 ` Hanjun Guo
0 siblings, 1 reply; 3+ messages in thread
From: Abbott Liu @ 2026-08-25 13:43 UTC (permalink / raw)
To: tony.luck, bp, jic23, ardb, rafael.j.wysocki, guohanjun,
mchehab+huawei, luoshengwei, jason, danielf, linux-edac,
linux-kernel
Cc: liuwenliang, yangzhuohao1, douzhaolei, zouyipeng, wangbing6,
nixiaoming
The vsei_len < 0 error path did not verify the pei_len and ctx_len.
When vsei_len is negative, section_length is too small to hold the
full record, yet pei_len and ctx_len were derived from
err_info_num/context_info_num and may describe regions beyond the
(long)err .. err + section_length buffer. To prevent trace_arm_event
from reading past the allocated record, sanitize the parameters:
move the cpu lookup above this path so it is available for tracing,
recalculate ctx_len and pei_len based on section_length, limit them,
set the corresponding pointers to NULL and lengths to 0 when there
is no remaining space.
pei_len and ctx_len become s32 so that the recalculated lengths can
be checked for negative values, and the cpu lookup is moved above the
section length checks so that both paths can share the final
trace_arm_event() call.
Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
drivers/ras/ras.c | 31 +++++++++++++++++++++----------
1 file changed, 21 insertions(+), 10 deletions(-)
diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 2540538a16a8..4a48a897f616 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
struct cper_arm_err_info *err_info;
struct cper_arm_ctx_info *ctx_info;
u8 *ven_err_data;
- u32 ctx_len = 0;
+ s32 ctx_len = 0;
int n, sz, cpu;
s32 vsei_len;
- u32 pei_len;
+ s32 pei_len;
u8 *pei_err, *ctx_err;
pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
@@ -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
ctx_len += sz;
}
+ cpu = GET_LOGICAL_INDEX(err->mpidr);
+ if (cpu < 0)
+ cpu = -1;
+
vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
if (vsei_len < 0) {
pr_warn(FW_BUG "section length: %d\n", err->section_length);
pr_warn(FW_BUG "section length is too small\n");
pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
vsei_len = 0;
- }
- ven_err_data = (u8 *)ctx_info;
-
- cpu = GET_LOGICAL_INDEX(err->mpidr);
- if (cpu < 0)
- cpu = -1;
-
- trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
+ ven_err_data = NULL;
+ ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
+ if (ctx_len < 0) {
+ ctx_len = 0;
+ ctx_err = NULL;
+ pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
+ if (pei_len < 0) {
+ pei_len = 0;
+ pei_err = NULL;
+ }
+ }
+ } else
+ ven_err_data = (u8 *)ctx_info;
+
+ trace_arm_event(err, pei_err, (u32)pei_len, ctx_err, (u32)ctx_len,
ven_err_data, (u32)vsei_len, sev, cpu);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event
2026-08-25 13:43 ` [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event Abbott Liu
@ 2026-09-03 9:56 ` Hanjun Guo
0 siblings, 0 replies; 3+ messages in thread
From: Hanjun Guo @ 2026-09-03 9:56 UTC (permalink / raw)
To: Abbott Liu, tony.luck, bp, jic23, ardb, rafael.j.wysocki,
mchehab+huawei, luoshengwei, jason, danielf, linux-edac,
linux-kernel
Cc: yangzhuohao1, douzhaolei, zouyipeng, wangbing6, nixiaoming
On 2026/8/25 21:43, Abbott Liu wrote:
> The vsei_len < 0 error path did not verify the pei_len and ctx_len.
> When vsei_len is negative, section_length is too small to hold the
> full record, yet pei_len and ctx_len were derived from
> err_info_num/context_info_num and may describe regions beyond the
> (long)err .. err + section_length buffer. To prevent trace_arm_event
> from reading past the allocated record, sanitize the parameters:
> move the cpu lookup above this path so it is available for tracing,
> recalculate ctx_len and pei_len based on section_length, limit them,
> set the corresponding pointers to NULL and lengths to 0 when there
> is no remaining space.
>
> pei_len and ctx_len become s32 so that the recalculated lengths can
> be checked for negative values, and the cpu lookup is moved above the
> section length checks so that both paths can share the final
> trace_arm_event() call.
>
> Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
>
Same here, no empty line between Fixes and Signed-off-by.
> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> ---
> drivers/ras/ras.c | 31 +++++++++++++++++++++----------
> 1 file changed, 21 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> index 2540538a16a8..4a48a897f616 100644
> --- a/drivers/ras/ras.c
> +++ b/drivers/ras/ras.c
> @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> struct cper_arm_err_info *err_info;
> struct cper_arm_ctx_info *ctx_info;
> u8 *ven_err_data;
> - u32 ctx_len = 0;
> + s32 ctx_len = 0;
> int n, sz, cpu;
> s32 vsei_len;
> - u32 pei_len;
> + s32 pei_len;
> u8 *pei_err, *ctx_err;
>
> pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
> @@ -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> ctx_len += sz;
> }
>
> + cpu = GET_LOGICAL_INDEX(err->mpidr);
> + if (cpu < 0)
> + cpu = -1;
> +
> vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
> if (vsei_len < 0) {
> pr_warn(FW_BUG "section length: %d\n", err->section_length);
> pr_warn(FW_BUG "section length is too small\n");
> pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
> vsei_len = 0;
> - }
> - ven_err_data = (u8 *)ctx_info;
> -
> - cpu = GET_LOGICAL_INDEX(err->mpidr);
> - if (cpu < 0)
> - cpu = -1;
> -
> - trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
> + ven_err_data = NULL;
> + ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
> + if (ctx_len < 0) {
> + ctx_len = 0;
> + ctx_err = NULL;
> + pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
> + if (pei_len < 0) {
> + pei_len = 0;
> + pei_err = NULL;
> + }
> + }
> + } else
> + ven_err_data = (u8 *)ctx_info;
else {
ven_err_data = (u8 *)ctx_info;
}
Thanks
Hanjun
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event
@ 2026-09-05 13:08 Liuwenliang (Abbott Liu)
0 siblings, 0 replies; 3+ messages in thread
From: Liuwenliang (Abbott Liu) @ 2026-09-05 13:08 UTC (permalink / raw)
To: Guohanjun (Hanjun Guo), tony.luck@intel.com, bp@alien8.de,
jic23@kernel.org, ardb@kernel.org, rafael.j.wysocki@intel.com,
mchehab+huawei@kernel.org, luoshengwei,
jason@os.amperecomputing.com, danielf@os.amperecomputing.com,
linux-edac@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: yangzhuohao (A), douzhaolei, zouyipeng, Wangbing, Nixiaoming
Hi Hanjun, Thinks for your review.
>On 2026/8/25 21:43, Abbott Liu wrote:
>> The vsei_len < 0 error path did not verify the pei_len and ctx_len.
>> When vsei_len is negative, section_length is too small to hold the
>> full record, yet pei_len and ctx_len were derived from
>> err_info_num/context_info_num and may describe regions beyond the
>> (long)err .. err + section_length buffer. To prevent trace_arm_event
>> from reading past the allocated record, sanitize the parameters:
>> move the cpu lookup above this path so it is available for tracing,
>> recalculate ctx_len and pei_len based on section_length, limit them,
>> set the corresponding pointers to NULL and lengths to 0 when there is
>> no remaining space.
>>
>> pei_len and ctx_len become s32 so that the recalculated lengths can be
>> checked for negative values, and the cpu lookup is moved above the
>> section length checks so that both paths can share the final
>> trace_arm_event() call.
>>
>> Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information
>> to userspace")
>>
>
>Same here, no empty line between Fixes and Signed-off-by.
I am very sorry for making such a basic mistake; this issue will be resolved
in the next version.
>
>> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
>> ---
>> drivers/ras/ras.c | 31 +++++++++++++++++++++----------
>> 1 file changed, 21 insertions(+), 10 deletions(-)
>>
>> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index
>> 2540538a16a8..4a48a897f616 100644
>> --- a/drivers/ras/ras.c
>> +++ b/drivers/ras/ras.c
>> @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>> struct cper_arm_err_info *err_info;
>> struct cper_arm_ctx_info *ctx_info;
>> u8 *ven_err_data;
>> - u32 ctx_len = 0;
>> + s32 ctx_len = 0;
>> int n, sz, cpu;
>> s32 vsei_len;
>> - u32 pei_len;
>> + s32 pei_len;
>> u8 *pei_err, *ctx_err;
>>
>> pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num; @@
>> -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>> ctx_len += sz;
>> }
>>
>> + cpu = GET_LOGICAL_INDEX(err->mpidr);
>> + if (cpu < 0)
>> + cpu = -1;
>> +
>> vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
>> if (vsei_len < 0) {
>> pr_warn(FW_BUG "section length: %d\n", err->section_length);
>> pr_warn(FW_BUG "section length is too small\n");
>> pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
>> vsei_len = 0;
>> - }
>> - ven_err_data = (u8 *)ctx_info;
>> -
>> - cpu = GET_LOGICAL_INDEX(err->mpidr);
>> - if (cpu < 0)
>> - cpu = -1;
>> -
>> - trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
>> + ven_err_data = NULL;
>> + ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
>> + if (ctx_len < 0) {
>> + ctx_len = 0;
>> + ctx_err = NULL;
>> + pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
>> + if (pei_len < 0) {
>> + pei_len = 0;
>> + pei_err = NULL;
>> + }
>> + }
>> + } else
>> + ven_err_data = (u8 *)ctx_info;
>
>else {
> ven_err_data = (u8 *)ctx_info;
>}
>
This issue will be resolved in next version.
>Thanks
>Hanjun
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-05 13:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-05 13:08 [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event Liuwenliang (Abbott Liu)
-- strict thread matches above, loose matches on Subject: below --
2026-08-25 13:43 [PATCH v2 0/2] RAS: Fix ARM processor error bounds checking Abbott Liu
2026-08-25 13:43 ` [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event Abbott Liu
2026-09-03 9:56 ` Hanjun Guo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).