* Re: [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors
@ 2026-09-21 1:29 Liuwenliang (Abbott Liu)
0 siblings, 0 replies; 3+ messages in thread
From: Liuwenliang (Abbott Liu) @ 2026-09-21 1:29 UTC (permalink / raw)
To: Guohanjun (Hanjun Guo),
tony.luck, bp, ardb, mchehab+huawei, rafael.j.wysocki, jic23,
jason, danielf, luoshengwei, linux-edac, linux-kernel
Cc: yangzhuohao (A),
douzhaolei, zouyipeng, Wangbing, Nixiaoming,
ACPI Devel Maling List, Liuwenliang (Abbott Liu)
Hi Hanjun,
Thank you for the review.
On 2026/9/17 10:13, Hanjun Guo wrote:
> On 2026/9/9 19:28, Abbott Liu wrote:
> > Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
> > allocated memory") added bounds checks for malformed ARM processor
> > error records but contained a bug:
> >
> > In log_arm_hw_error(), the ctx_info bounds check is inverted. The
> > condition "sz + (long)ctx_info - (long)err >= err->section_length"
> > adds ctx_info->size when the context header is already past the end
> > of the section instead of when it is within bounds. So change the
> > comparison to <=.
> >
> > Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> > Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> > ---
> > drivers/ras/ras.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> > index 03df3db62334..2540538a16a8 100644
> > --- a/drivers/ras/ras.c
> > +++ b/drivers/ras/ras.c
> > @@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> > for (n = 0; n < err->context_info_num; n++) {
> > sz = sizeof(struct cper_arm_ctx_info);
> >
> > - if (sz + (long)ctx_info - (long)err >= err->section_length)
> > + if (sz + (long)ctx_info - (long)err <= err->section_length)
> > sz += ctx_info->size;
> >
> > ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
> >
>
> Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Thanks, I will add your Reviewed-by tag in v5, there will be no code changes in
that version, so the tag remains valid.
>
> Thanks
> Hanjun
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors
2026-09-09 11:28 ` [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors Abbott Liu
@ 2026-09-17 2:13 ` Hanjun Guo
0 siblings, 0 replies; 3+ messages in thread
From: Hanjun Guo @ 2026-09-17 2:13 UTC (permalink / raw)
To: Abbott Liu, tony.luck, bp, ardb, mchehab+huawei,
rafael.j.wysocki, jic23, jason, danielf, luoshengwei, linux-edac,
linux-kernel
Cc: yangzhuohao1, douzhaolei, zouyipeng, wangbing6, nixiaoming,
ACPI Devel Maling List
On 2026/9/9 19:28, Abbott Liu wrote:
> Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
> allocated memory") added bounds checks for malformed ARM processor
> error records but contained a bug:
>
> In log_arm_hw_error(), the ctx_info bounds check is inverted. The
> condition "sz + (long)ctx_info - (long)err >= err->section_length"
> adds ctx_info->size when the context header is already past the end
> of the section instead of when it is within bounds. So change the
> comparison to <=.
>
> Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> ---
> drivers/ras/ras.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> index 03df3db62334..2540538a16a8 100644
> --- a/drivers/ras/ras.c
> +++ b/drivers/ras/ras.c
> @@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> for (n = 0; n < err->context_info_num; n++) {
> sz = sizeof(struct cper_arm_ctx_info);
>
> - if (sz + (long)ctx_info - (long)err >= err->section_length)
> + if (sz + (long)ctx_info - (long)err <= err->section_length)
> sz += ctx_info->size;
>
> ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Thanks
Hanjun
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors
2026-09-09 11:28 [PATCH v4 0/3] RAS: Fix ARM processor error bounds checking Abbott Liu
@ 2026-09-09 11:28 ` Abbott Liu
2026-09-17 2:13 ` Hanjun Guo
0 siblings, 1 reply; 3+ messages in thread
From: Abbott Liu @ 2026-09-09 11:28 UTC (permalink / raw)
To: tony.luck, bp, ardb, mchehab+huawei, rafael.j.wysocki, guohanjun,
jic23, jason, danielf, luoshengwei, linux-edac, linux-kernel
Cc: yangzhuohao1, douzhaolei, zouyipeng, wangbing6, nixiaoming, liuwenliang
Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") added bounds checks for malformed ARM processor
error records but contained a bug:
In log_arm_hw_error(), the ctx_info bounds check is inverted. The
condition "sz + (long)ctx_info - (long)err >= err->section_length"
adds ctx_info->size when the context header is already past the end
of the section instead of when it is within bounds. So change the
comparison to <=.
Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
---
drivers/ras/ras.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 03df3db62334..2540538a16a8 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
for (n = 0; n < err->context_info_num; n++) {
sz = sizeof(struct cper_arm_ctx_info);
- if (sz + (long)ctx_info - (long)err >= err->section_length)
+ if (sz + (long)ctx_info - (long)err <= err->section_length)
sz += ctx_info->size;
ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-21 1:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-21 1:29 [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors Liuwenliang (Abbott Liu)
-- strict thread matches above, loose matches on Subject: below --
2026-09-09 11:28 [PATCH v4 0/3] RAS: Fix ARM processor error bounds checking Abbott Liu
2026-09-09 11:28 ` [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors Abbott Liu
2026-09-17 2:13 ` Hanjun Guo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®