[PATCH v4 0/3] RAS: Fix ARM processor error bounds checking

[PATCH v4 0/3] RAS: Fix ARM processor error bounds checking

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") and commit 05954511b73e ("RAS: Report all ARM
processor CPER information to userspace") introduced bounds checking
for malformed ARM processor error records in log_arm_hw_error().
However, three issues remain:

1. The ctx_info bounds check condition is inverted: it adds
   ctx_info->size when the context header is already past the end of
   the section instead of when it is within bounds.

2. When vsei_len < 0, the error path does not verify pei_len and
   ctx_len. Since these are derived from err_info_num and
   context_info_num, they may describe regions beyond the allocated
   record, causing trace_arm_event() to read out of bounds.

3. ctx_info->size is a u32 taken directly from the firmware-generated
   record. A value over 0x7fffffff overflows the signed int sz used
   to advance ctx_info, so the iteration can walk past the end of the
   section.

Patch 1 fixes the inverted bounds check for context info iteration.
Patch 2 sanitizes pei_len/ctx_len/ven_err_data in the vsei_len < 0
error path to prevent out-of-bounds reads in trace_arm_event().
Patch 3 checks each context entry with 64-bit arithmetic so that both
the header and the context data fit in the section, and stops the walk
at the first entry that does not fit, so a malformed size cannot
overflow sz and walk ctx_info out of the section.

Changes in v4:
  - Remove the empty line between the Fixes: and Signed-off-by: tags
    in patches 1 and 2, per Hanjun Guo's comments.
  - Add braces around the else branch that assigns ven_err_data in
    patch 2, as suggested by Hanjun Guo.
  - Add new patch 3 to check each context entry with 64-bit
    arithmetic and stop the walk at the first entry that does not fit
    in the section, so a ctx_info->size over 0x7fffffff cannot
    overflow the signed int sz and walk ctx_info past the section,
    addressing Hanjun Guo's overflow comment.

Changes in v3:
  - There was no change, and the email was sent by mistake.

Changes in v2:
  - Split the original single patch into two separate patches, one
    for each distinct fix, to ease review and backporting.

v2:
  RAS: Fix ARM processor error bounds checking
  https://lore.kernel.org/all/20260825134323.4181892-1-liuwenliang@huawei.com/

v1:
  RAS: Fix out-of-range section_length in ARM processor error handling
  https://lore.kernel.org/all/20260820131829.1006371-1-liuwenliang@huawei.com/

Abbott Liu (3):
  RAS: Fix inverted context info bounds check in ARM processor errors
  RAS: Fix out-of-bounds read when tracing arm_event
  RAS: Fix integer overflow in ARM processor error context walk

 drivers/ras/ras.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

-- 
2.43.0

[PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") added bounds checks for malformed ARM processor
error records but contained a bug:

  In log_arm_hw_error(), the ctx_info bounds check is inverted. The
  condition "sz + (long)ctx_info - (long)err >= err->section_length"
  adds ctx_info->size when the context header is already past the end
  of the section instead of when it is within bounds. So change the
  comparison to <=.

Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
 drivers/ras/ras.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 03df3db62334..2540538a16a8 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	for (n = 0; n < err->context_info_num; n++) {
 		sz = sizeof(struct cper_arm_ctx_info);
 
-		if (sz + (long)ctx_info - (long)err >= err->section_length)
+		if (sz + (long)ctx_info - (long)err <= err->section_length)
 			sz += ctx_info->size;
 
 		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
-- 
2.43.0

[PATCH v4 2/3] RAS: Fix out-of-bounds read when tracing arm_event

[Abbott Liu]

The vsei_len < 0 error path did not verify the pei_len and ctx_len.
When vsei_len is negative, section_length is too small to hold the
full record, yet pei_len and ctx_len were derived from
err_info_num/context_info_num and may describe regions beyond the
(long)err .. err + section_length buffer. To prevent trace_arm_event
from reading past the allocated record, sanitize the parameters:
recalculate ctx_len and pei_len based on section_length, limit them,
and set the corresponding pointers to NULL and lengths to 0 when
there is no remaining space.

pei_len and ctx_len become s32 so that the recalculated lengths can
be checked for negative values.

Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
 drivers/ras/ras.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 2540538a16a8..085fe2d980e5 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	struct cper_arm_err_info *err_info;
 	struct cper_arm_ctx_info *ctx_info;
 	u8 *ven_err_data;
-	u32 ctx_len = 0;
+	s32 ctx_len = 0;
 	int n, sz, cpu;
 	s32 vsei_len;
-	u32 pei_len;
+	s32 pei_len;
 	u8 *pei_err, *ctx_err;
 
 	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
@@ -87,14 +87,28 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 		pr_warn(FW_BUG "section length is too small\n");
 		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
 		vsei_len = 0;
+		ven_err_data = NULL;
+
+		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
+		if (ctx_len < 0) {
+			ctx_len = 0;
+			ctx_err = NULL;
+
+			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
+			if (pei_len < 0) {
+				pei_len = 0;
+				pei_err = NULL;
+			}
+		}
+	} else {
+		ven_err_data = (u8 *)ctx_info;
 	}
-	ven_err_data = (u8 *)ctx_info;
 
 	cpu = GET_LOGICAL_INDEX(err->mpidr);
 	if (cpu < 0)
 		cpu = -1;
 
-	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
+	trace_arm_event(err, pei_err, (u32)pei_len, ctx_err, (u32)ctx_len,
 			ven_err_data, (u32)vsei_len, sev, cpu);
 }
 
-- 
2.43.0

[PATCH v4 3/3] RAS: Fix integer overflow in ARM processor error context walk

[Abbott Liu]

sz is an int while ctx_info->size is a u32, so a size greater than
0x7fffffff makes sz negative and moves ctx_info below the error
record. The header check of the next iteration then passes, because
the offset of ctx_info relative to err is negative, and ctx_info->size
is read from a wild pointer. A negative sz also deflates ctx_len,
which can keep vsei_len non-negative, so the truncated record path is
not taken and the out-of-section ctx_info is traced as vendor error
data.

Check each context entry with 64-bit arithmetic: both the header and
the context data must fit within err + section_length. Stop the walk
at the first entry that does not fit, flag the record as overflowed
and take the truncated record path, which sanitizes the values
passed to trace_arm_event(), instead of detecting the overflow after
the walk only from a negative vsei_len.

Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
Reported-by: Hanjun Guo <guohanjun@huawei.com>
Link: https://lore.kernel.org/all/20260825134323.4181892-1-liuwenliang@huawei.com/
Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
 drivers/ras/ras.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 085fe2d980e5..db378fd6f1ff 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -59,6 +59,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	struct cper_arm_ctx_info *ctx_info;
 	u8 *ven_err_data;
 	s32 ctx_len = 0;
+	bool overflow = false;
 	int n, sz, cpu;
 	s32 vsei_len;
 	s32 pei_len;
@@ -74,15 +75,21 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	for (n = 0; n < err->context_info_num; n++) {
 		sz = sizeof(struct cper_arm_ctx_info);
 
-		if (sz + (long)ctx_info - (long)err <= err->section_length)
+		if ((sz + (long)ctx_info - (long)err <= err->section_length) &&
+		    ((u64)sz + ctx_info->size + ((long)ctx_info - (long)err) <=
+		    err->section_length)) {
 			sz += ctx_info->size;
+		} else {
+			overflow = true;
+			break;
+		}
 
 		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
 		ctx_len += sz;
 	}
 
 	vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
-	if (vsei_len < 0) {
+	if (overflow || vsei_len < 0) {
 		pr_warn(FW_BUG "section length: %d\n", err->section_length);
 		pr_warn(FW_BUG "section length is too small\n");
 		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
-- 
2.43.0

Re: [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors

[Hanjun Guo]

On 2026/9/9 19:28, Abbott Liu wrote:
> Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
> allocated memory") added bounds checks for malformed ARM processor
> error records but contained a bug:
> 
>    In log_arm_hw_error(), the ctx_info bounds check is inverted. The
>    condition "sz + (long)ctx_info - (long)err >= err->section_length"
>    adds ctx_info->size when the context header is already past the end
>    of the section instead of when it is within bounds. So change the
>    comparison to <=.
> 
> Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> ---
>   drivers/ras/ras.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> index 03df3db62334..2540538a16a8 100644
> --- a/drivers/ras/ras.c
> +++ b/drivers/ras/ras.c
> @@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>   	for (n = 0; n < err->context_info_num; n++) {
>   		sz = sizeof(struct cper_arm_ctx_info);
>   
> -		if (sz + (long)ctx_info - (long)err >= err->section_length)
> +		if (sz + (long)ctx_info - (long)err <= err->section_length)
>   			sz += ctx_info->size;
>   
>   		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
> 

Reviewed-by: Hanjun Guo <guohanjun@huawei.com>

Thanks
Hanjun

Re: [PATCH v4 2/3] RAS: Fix out-of-bounds read when tracing arm_event

[Hanjun Guo]

On 2026/9/9 19:28, Abbott Liu wrote:
> The vsei_len < 0 error path did not verify the pei_len and ctx_len.
> When vsei_len is negative, section_length is too small to hold the
> full record, yet pei_len and ctx_len were derived from
> err_info_num/context_info_num and may describe regions beyond the
> (long)err .. err + section_length buffer. To prevent trace_arm_event
> from reading past the allocated record, sanitize the parameters:
> recalculate ctx_len and pei_len based on section_length, limit them,
> and set the corresponding pointers to NULL and lengths to 0 when
> there is no remaining space.
> 
> pei_len and ctx_len become s32 so that the recalculated lengths can
> be checked for negative values.
> 
> Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> ---
>   drivers/ras/ras.c | 22 ++++++++++++++++++----
>   1 file changed, 18 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> index 2540538a16a8..085fe2d980e5 100644
> --- a/drivers/ras/ras.c
> +++ b/drivers/ras/ras.c
> @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>   	struct cper_arm_err_info *err_info;
>   	struct cper_arm_ctx_info *ctx_info;
>   	u8 *ven_err_data;
> -	u32 ctx_len = 0;
> +	s32 ctx_len = 0;
>   	int n, sz, cpu;
>   	s32 vsei_len;
> -	u32 pei_len;
> +	s32 pei_len;
>   	u8 *pei_err, *ctx_err;
>   
>   	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
> @@ -87,14 +87,28 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>   		pr_warn(FW_BUG "section length is too small\n");
>   		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
>   		vsei_len = 0;
> +		ven_err_data = NULL;
> +
> +		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
> +		if (ctx_len < 0) {
> +			ctx_len = 0;
> +			ctx_err = NULL;
> +
> +			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
> +			if (pei_len < 0) {
> +				pei_len = 0;
> +				pei_err = NULL;
> +			}
> +		}
> +	} else {
> +		ven_err_data = (u8 *)ctx_info;
>   	}
> -	ven_err_data = (u8 *)ctx_info;
>   
>   	cpu = GET_LOGICAL_INDEX(err->mpidr);
>   	if (cpu < 0)
>   		cpu = -1;
>   
> -	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
> +	trace_arm_event(err, pei_err, (u32)pei_len, ctx_err, (u32)ctx_len,
>   			ven_err_data, (u32)vsei_len, sev, cpu);
>   }

Reviewed-by: Hanjun Guo <guohanjun@huawei.com>

Thanks
Hanjun

Re: [PATCH v4 2/3] RAS: Fix out-of-bounds read when tracing arm_event

[Liuwenliang (Abbott Liu)]

Hi Hanjun,

Thank you for the review.

On 2026/9/17 10:14, Hanjun Guo wrote:
> On 2026/9/9 19:28, Abbott Liu wrote:
> > The vsei_len < 0 error path did not verify the pei_len and ctx_len.
> > When vsei_len is negative, section_length is too small to hold the
> > full record, yet pei_len and ctx_len were derived from
> > err_info_num/context_info_num and may describe regions beyond the
> > (long)err .. err + section_length buffer. To prevent trace_arm_event
> > from reading past the allocated record, sanitize the parameters:
> > recalculate ctx_len and pei_len based on section_length, limit them,
> > and set the corresponding pointers to NULL and lengths to 0 when
> > there is no remaining space.
> >
> > pei_len and ctx_len become s32 so that the recalculated lengths can
> > be checked for negative values.
> >
> > Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to userspace")
> > Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> > ---
> >   drivers/ras/ras.c | 22 ++++++++++++++++++----
> >   1 file changed, 18 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> > index 2540538a16a8..085fe2d980e5 100644
> > --- a/drivers/ras/ras.c
> > +++ b/drivers/ras/ras.c
> > @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> >   	struct cper_arm_err_info *err_info;
> >   	struct cper_arm_ctx_info *ctx_info;
> >   	u8 *ven_err_data;
> > -	u32 ctx_len = 0;
> > +	s32 ctx_len = 0;
> >   	int n, sz, cpu;
> >   	s32 vsei_len;
> > -	u32 pei_len;
> > +	s32 pei_len;
> >   	u8 *pei_err, *ctx_err;
> >
> >   	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
> > @@ -87,14 +87,28 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> >   		pr_warn(FW_BUG "section length is too small\n");
> >   		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
> >   		vsei_len = 0;
> > +		ven_err_data = NULL;
> > +
> > +		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
> > +		if (ctx_len < 0) {
> > +			ctx_len = 0;
> > +			ctx_err = NULL;
> > +
> > +			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
> > +			if (pei_len < 0) {
> > +				pei_len = 0;
> > +				pei_err = NULL;
> > +			}
> > +		}
> > +	} else {
> > +		ven_err_data = (u8 *)ctx_info;
> >   	}
> > -	ven_err_data = (u8 *)ctx_info;
> >
> >   	cpu = GET_LOGICAL_INDEX(err->mpidr);
> >   	if (cpu < 0)
> >   		cpu = -1;
> >
> > -	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
> > +	trace_arm_event(err, pei_err, (u32)pei_len, ctx_err, (u32)ctx_len,
> >   			ven_err_data, (u32)vsei_len, sev, cpu);
> >   }
>
> Reviewed-by: Hanjun Guo <guohanjun@huawei.com>

Thanks, I will add your Reviewed-by tag in v5, there will be no code changes in
that version, so the tag remains valid.

>
> Thanks
> Hanjun