[PATCH v2 0/2] RAS: Fix ARM processor error bounds checking

[PATCH v2 0/2] RAS: Fix ARM processor error bounds checking

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") and commit 05954511b73e ("RAS: Report all ARM
processor CPER information to userspace") introduced bounds checking
for malformed ARM processor error records in log_arm_hw_error().
However, two issues remain:

1. The ctx_info bounds check condition is inverted: it adds
   ctx_info->size when the context header is already past the end of
   the section instead of when it is within bounds.

2. When vsei_len < 0, the error path does not verify pei_len and
   ctx_len. Since these are derived from err_info_num and
   context_info_num, they may describe regions beyond the allocated
   record, causing trace_arm_event() to read out of bounds.

Patch 1 fixes the inverted bounds check for context info iteration.
Patch 2 sanitizes pei_len/ctx_len/ven_err_data in the vsei_len < 0
error path to prevent out-of-bounds reads in trace_arm_event().

Changes in v2:
  - Split the original single patch into two separate patches, one
    for each distinct fix, to ease review and backporting.

v1:
  RAS: Fix out-of-range section_length in ARM processor error handling
  https://lore.kernel.org/all/20260820131829.1006371-1-liuwenliang@huawei.com/

Abbott Liu (2):
  RAS: Fix inverted context info bounds check in ARM processor errors
  RAS: Fix out-of-bounds read when tracing arm_event

 drivers/ras/ras.c | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

-- 
2.43.0

[PATCH v2 1/2] RAS: Fix inverted context info bounds check in ARM processor errors

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") added bounds checks for malformed ARM processor
error records but contained a bug:

  In log_arm_hw_error(), the ctx_info bounds check is inverted. The
  condition `sz + (long)ctx_info - (long)err >= err->section_length`
  adds ctx_info->size when the context header is already past the end
  of the section instead of when it is within bounds. So change the
  comparison to <=.

Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")

Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
 drivers/ras/ras.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 03df3db62334..2540538a16a8 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	for (n = 0; n < err->context_info_num; n++) {
 		sz = sizeof(struct cper_arm_ctx_info);
 
-		if (sz + (long)ctx_info - (long)err >= err->section_length)
+		if (sz + (long)ctx_info - (long)err <= err->section_length)
 			sz += ctx_info->size;
 
 		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
-- 
2.43.0

[PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event

[Abbott Liu]

The vsei_len < 0 error path did not verify the pei_len and ctx_len.
When vsei_len is negative, section_length is too small to hold the
full record, yet pei_len and ctx_len were derived from
err_info_num/context_info_num and may describe regions beyond the
(long)err .. err + section_length buffer. To prevent trace_arm_event
from reading past the allocated record, sanitize the parameters:
move the cpu lookup above this path so it is available for tracing,
recalculate ctx_len and pei_len based on section_length, limit them,
set the corresponding pointers to NULL and lengths to 0  when there
is no remaining space.

pei_len and ctx_len become s32 so that the recalculated lengths can
be checked for negative values, and the cpu lookup is moved above the
section length checks so that both paths can share the final
trace_arm_event() call.

Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")

Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
 drivers/ras/ras.c | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 2540538a16a8..4a48a897f616 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	struct cper_arm_err_info *err_info;
 	struct cper_arm_ctx_info *ctx_info;
 	u8 *ven_err_data;
-	u32 ctx_len = 0;
+	s32 ctx_len = 0;
 	int n, sz, cpu;
 	s32 vsei_len;
-	u32 pei_len;
+	s32 pei_len;
 	u8 *pei_err, *ctx_err;
 
 	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
@@ -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 		ctx_len += sz;
 	}
 
+	cpu = GET_LOGICAL_INDEX(err->mpidr);
+	if (cpu < 0)
+		cpu = -1;
+
 	vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
 	if (vsei_len < 0) {
 		pr_warn(FW_BUG "section length: %d\n", err->section_length);
 		pr_warn(FW_BUG "section length is too small\n");
 		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
 		vsei_len = 0;
-	}
-	ven_err_data = (u8 *)ctx_info;
-
-	cpu = GET_LOGICAL_INDEX(err->mpidr);
-	if (cpu < 0)
-		cpu = -1;
-
-	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
+		ven_err_data = NULL;
+		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
+		if (ctx_len < 0) {
+			ctx_len = 0;
+			ctx_err = NULL;
+			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
+			if (pei_len < 0) {
+				pei_len = 0;
+				pei_err = NULL;
+			}
+		}
+	} else
+		ven_err_data = (u8 *)ctx_info;
+
+	trace_arm_event(err, pei_err, (u32)pei_len, ctx_err, (u32)ctx_len,
 			ven_err_data, (u32)vsei_len, sev, cpu);
 }
 
-- 
2.43.0

Re: [PATCH v2 1/2] RAS: Fix inverted context info bounds check in ARM processor errors

[Hanjun Guo]

Hi Abbott,

On 2026/8/25 21:43, Abbott Liu wrote:
> Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
> allocated memory") added bounds checks for malformed ARM processor
> error records but contained a bug:
> 
>    In log_arm_hw_error(), the ctx_info bounds check is inverted. The
>    condition `sz + (long)ctx_info - (long)err >= err->section_length`
>    adds ctx_info->size when the context header is already past the end
>    of the section instead of when it is within bounds. So change the
>    comparison to <=.
> 
> Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> 

This empty line is not needed.

> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> ---
>   drivers/ras/ras.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> index 03df3db62334..2540538a16a8 100644
> --- a/drivers/ras/ras.c
> +++ b/drivers/ras/ras.c
> @@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>   	for (n = 0; n < err->context_info_num; n++) {
>   		sz = sizeof(struct cper_arm_ctx_info);
>   
> -		if (sz + (long)ctx_info - (long)err >= err->section_length)
> +		if (sz + (long)ctx_info - (long)err <= err->section_length)
>   			sz += ctx_info->size;

sz is an int and ctx_info->size is u32, if ctx_info->size is big enough
for example over 0x7fffffff, the sz will be negative.

>   
>   		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);

if the sz is negative, the ctx_info may pointer to a wrong place.

ctx_info->size will not over 0x7fffffff in practical but should we
consider the overflows?

Thanks
Hanjun

> 

Re: [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event

[Hanjun Guo]

On 2026/8/25 21:43, Abbott Liu wrote:
> The vsei_len < 0 error path did not verify the pei_len and ctx_len.
> When vsei_len is negative, section_length is too small to hold the
> full record, yet pei_len and ctx_len were derived from
> err_info_num/context_info_num and may describe regions beyond the
> (long)err .. err + section_length buffer. To prevent trace_arm_event
> from reading past the allocated record, sanitize the parameters:
> move the cpu lookup above this path so it is available for tracing,
> recalculate ctx_len and pei_len based on section_length, limit them,
> set the corresponding pointers to NULL and lengths to 0  when there
> is no remaining space.
> 
> pei_len and ctx_len become s32 so that the recalculated lengths can
> be checked for negative values, and the cpu lookup is moved above the
> section length checks so that both paths can share the final
> trace_arm_event() call.
> 
> Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
> 

Same here, no empty line between Fixes and Signed-off-by.

> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> ---
>   drivers/ras/ras.c | 31 +++++++++++++++++++++----------
>   1 file changed, 21 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> index 2540538a16a8..4a48a897f616 100644
> --- a/drivers/ras/ras.c
> +++ b/drivers/ras/ras.c
> @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>   	struct cper_arm_err_info *err_info;
>   	struct cper_arm_ctx_info *ctx_info;
>   	u8 *ven_err_data;
> -	u32 ctx_len = 0;
> +	s32 ctx_len = 0;
>   	int n, sz, cpu;
>   	s32 vsei_len;
> -	u32 pei_len;
> +	s32 pei_len;
>   	u8 *pei_err, *ctx_err;
>   
>   	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
> @@ -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>   		ctx_len += sz;
>   	}
>   
> +	cpu = GET_LOGICAL_INDEX(err->mpidr);
> +	if (cpu < 0)
> +		cpu = -1;
> +
>   	vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
>   	if (vsei_len < 0) {
>   		pr_warn(FW_BUG "section length: %d\n", err->section_length);
>   		pr_warn(FW_BUG "section length is too small\n");
>   		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
>   		vsei_len = 0;
> -	}
> -	ven_err_data = (u8 *)ctx_info;
> -
> -	cpu = GET_LOGICAL_INDEX(err->mpidr);
> -	if (cpu < 0)
> -		cpu = -1;
> -
> -	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
> +		ven_err_data = NULL;
> +		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
> +		if (ctx_len < 0) {
> +			ctx_len = 0;
> +			ctx_err = NULL;
> +			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
> +			if (pei_len < 0) {
> +				pei_len = 0;
> +				pei_err = NULL;
> +			}
> +		}
> +	} else
> +		ven_err_data = (u8 *)ctx_info;

else {
	ven_err_data = (u8 *)ctx_info;
}

Thanks
Hanjun

Re: [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event

[Liuwenliang (Abbott Liu)]

Hi Hanjun, Thinks for your review.

>On 2026/8/25 21:43, Abbott Liu wrote:
>> The vsei_len < 0 error path did not verify the pei_len and ctx_len.
>> When vsei_len is negative, section_length is too small to hold the 
>> full record, yet pei_len and ctx_len were derived from 
>> err_info_num/context_info_num and may describe regions beyond the 
>> (long)err .. err + section_length buffer. To prevent trace_arm_event 
>> from reading past the allocated record, sanitize the parameters:
>> move the cpu lookup above this path so it is available for tracing, 
>> recalculate ctx_len and pei_len based on section_length, limit them, 
>> set the corresponding pointers to NULL and lengths to 0  when there is 
>> no remaining space.
>> 
>> pei_len and ctx_len become s32 so that the recalculated lengths can be 
>> checked for negative values, and the cpu lookup is moved above the 
>> section length checks so that both paths can share the final
>> trace_arm_event() call.
>> 
>> Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information 
>> to userspace")
>> 
>
>Same here, no empty line between Fixes and Signed-off-by.

I am very sorry for making such a basic mistake; this issue will be resolved
in the next version.

>
>> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
>> ---
>>   drivers/ras/ras.c | 31 +++++++++++++++++++++----------
>>   1 file changed, 21 insertions(+), 10 deletions(-)
>> 
>> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 
>> 2540538a16a8..4a48a897f616 100644
>> --- a/drivers/ras/ras.c
>> +++ b/drivers/ras/ras.c
>> @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>>   	struct cper_arm_err_info *err_info;
>>   	struct cper_arm_ctx_info *ctx_info;
>>   	u8 *ven_err_data;
>> -	u32 ctx_len = 0;
>> +	s32 ctx_len = 0;
>>   	int n, sz, cpu;
>>   	s32 vsei_len;
>> -	u32 pei_len;
>> +	s32 pei_len;
>>   	u8 *pei_err, *ctx_err;
>>   
>>   	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num; @@ 
>> -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>>   		ctx_len += sz;
>>   	}
>>   
>> +	cpu = GET_LOGICAL_INDEX(err->mpidr);
>> +	if (cpu < 0)
>> +		cpu = -1;
>> +
>>   	vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
>>   	if (vsei_len < 0) {
>>   		pr_warn(FW_BUG "section length: %d\n", err->section_length);
>>   		pr_warn(FW_BUG "section length is too small\n");
>>   		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
>>   		vsei_len = 0;
>> -	}
>> -	ven_err_data = (u8 *)ctx_info;
>> -
>> -	cpu = GET_LOGICAL_INDEX(err->mpidr);
>> -	if (cpu < 0)
>> -		cpu = -1;
>> -
>> -	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
>> +		ven_err_data = NULL;
>> +		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
>> +		if (ctx_len < 0) {
>> +			ctx_len = 0;
>> +			ctx_err = NULL;
>> +			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
>> +			if (pei_len < 0) {
>> +				pei_len = 0;
>> +				pei_err = NULL;
>> +			}
>> +		}
>> +	} else
>> +		ven_err_data = (u8 *)ctx_info;
>
>else {
>	ven_err_data = (u8 *)ctx_info;
>}
>

This issue will be resolved in next version.

>Thanks
>Hanjun
>