From: TanZheng <tanzheng@kylinos.cn>

In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm
header with (err + 1), the remaining length was reduced by sizeof(err)
(pointer size) instead of sizeof(*err) (structure size).

That overestimates the bytes left for cper_arm_err_info records and can
let the parser read past the CPER section when err_info_num is large
enough relative to error_data_length.

Use sizeof(*err) so the length accounting matches the pointer advance
and the earlier sizeof(*err) size check.

Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
Cc: stable@vger.kernel.org
Signed-off-by: TanZheng <tanzheng@kylinos.cn>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
---
v2:
- add Cc: stable@vger.kernel.org

 drivers/acpi/apei/ghes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 3236a3ce79d6..e6362da72d15 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -576,7 +576,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
 		return false;
 
 	p = (char *)(err + 1);
-	length -= sizeof(err);
+	length -= sizeof(*err);
 
 	for (i = 0; i < err->err_info_num; i++) {
 		struct cper_arm_err_info *err_info;
-- 
2.25.1

On Thu, Aug 6, 2026 at 3:10 AM <kensanya@163.com> wrote:
>
> From: TanZheng <tanzheng@kylinos.cn>
>
> In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm
> header with (err + 1), the remaining length was reduced by sizeof(err)
> (pointer size) instead of sizeof(*err) (structure size).
>
> That overestimates the bytes left for cper_arm_err_info records and can
> let the parser read past the CPER section when err_info_num is large
> enough relative to error_data_length.
>
> Use sizeof(*err) so the length accounting matches the pointer advance
> and the earlier sizeof(*err) size check.
>
> Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> Cc: stable@vger.kernel.org
> Signed-off-by: TanZheng <tanzheng@kylinos.cn>
> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
> ---
> v2:
> - add Cc: stable@vger.kernel.org
>
>  drivers/acpi/apei/ghes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index 3236a3ce79d6..e6362da72d15 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c
> @@ -576,7 +576,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
>                 return false;
>
>         p = (char *)(err + 1);
> -       length -= sizeof(err);
> +       length -= sizeof(*err);
>
>         for (i = 0; i < err->err_info_num; i++) {
>                 struct cper_arm_err_info *err_info;
> --

Applied as 7.3 material, thanks!