Hi Yazen, Borislav, Tony,

This series fixes several bugs in the AMD FRU Memory Poison Manager
driver.

Patch 1 fixes an out-of-bounds read in the for_each_fru macro caused by
the comma operator evaluating the array access before the bounds check.

Patch 2 fixes an uninitialized stack bitmap in save_new_records() that
could cause the rollback path to clear ERST records that were not created
in the current initialization pass.

Patch 3 makes the max_nr_entries module parameter read-only (0444),
preventing runtime writes that could exceed the allocated flexible array
size.

Patch 4 fixes a spurious BUG when erst_get_record_id_begin() fails,
because the error path unconditionally calls erst_get_record_id_end()
which triggers BUG_ON.

All four bugs have been present since the original introduction of the
AMD FMPM driver.

Changes since v1 [1]:
- All patches: Use RAS/AMD/FMPM: subject prefix to match existing
  convention (Yazen Ghannam)
- Patch 1: Replace UBSan with KASAN in commit message, as KASAN is the
  appropriate sanitizer for out-of-bounds memory accesses (Yazen Ghannam)
- Patch 1: Use ", true" instead of ", 1" in the for_each_fru macro to
  clearly indicate a boolean value (Yazen Ghannam)
- Patch 2: Initialize DECLARE_BITMAP at declaration with = { 0 } instead
  of calling bitmap_zero() separately (Yazen Ghannam)
- Patch 4: Fix commit message to accurately describe the comment in
  erst_get_record_id_end() (Yazen Ghannam)
- Patch 4: Simplify error path by using goto out and moving the out:
  label above kfree(old), removing the out_free label (Yazen Ghannam)

[1] https://lore.kernel.org/r/20260821094748.145394-1-qirui.001@bytedance.com

Rui Qi (4):
  RAS/AMD/FMPM: Fix out-of-bounds read in for_each_fru macro
  RAS/AMD/FMPM: Clear new records bitmap before rollback
  RAS/AMD/FMPM: Make max_nr_entries read-only
  RAS/AMD/FMPM: Fix spurious BUG when ERST record enumeration fails

 drivers/ras/amd/fmpm.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--
2.20.1

On 8/26/26 11:53 AM, Rui Qi wrote:
> Hi Yazen, Borislav, Tony,
> 
> This series fixes several bugs in the AMD FRU Memory Poison Manager
> driver.
> 
> Patch 1 fixes an out-of-bounds read in the for_each_fru macro caused by
> the comma operator evaluating the array access before the bounds check.
> 
> Patch 2 fixes an uninitialized stack bitmap in save_new_records() that
> could cause the rollback path to clear ERST records that were not created
> in the current initialization pass.
> 
> Patch 3 makes the max_nr_entries module parameter read-only (0444),
> preventing runtime writes that could exceed the allocated flexible array
> size.
> 
> Patch 4 fixes a spurious BUG when erst_get_record_id_begin() fails,
> because the error path unconditionally calls erst_get_record_id_end()
> which triggers BUG_ON.
> 
> All four bugs have been present since the original introduction of the
> AMD FMPM driver.
> 
> Changes since v1 [1]:
> - All patches: Use RAS/AMD/FMPM: subject prefix to match existing
>   convention (Yazen Ghannam)
> - Patch 1: Replace UBSan with KASAN in commit message, as KASAN is the
>   appropriate sanitizer for out-of-bounds memory accesses (Yazen Ghannam)
> - Patch 1: Use ", true" instead of ", 1" in the for_each_fru macro to
>   clearly indicate a boolean value (Yazen Ghannam)
> - Patch 2: Initialize DECLARE_BITMAP at declaration with = { 0 } instead
>   of calling bitmap_zero() separately (Yazen Ghannam)
> - Patch 4: Fix commit message to accurately describe the comment in
>   erst_get_record_id_end() (Yazen Ghannam)
> - Patch 4: Simplify error path by using goto out and moving the out:
>   label above kfree(old), removing the out_free label (Yazen Ghannam)
> 
> [1] https://lore.kernel.org/r/20260821094748.145394-1-qirui.001@bytedance.com
> 
> Rui Qi (4):
>   RAS/AMD/FMPM: Fix out-of-bounds read in for_each_fru macro
>   RAS/AMD/FMPM: Clear new records bitmap before rollback
>   RAS/AMD/FMPM: Make max_nr_entries read-only
>   RAS/AMD/FMPM: Fix spurious BUG when ERST record enumeration fails
> 
>  drivers/ras/amd/fmpm.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> --
> 2.20.1

Hi Yazen,

Gentle ping on this series.

This v2 incorporates all your feedback on v1, including the subject
prefix updates and the suggested changes to patches 1, 2, and 4.
Could you please take another look when you have a chance?

Thanks,
Rui