From nobody Thu Sep 24 20:37:27 2026 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2417044A725; Mon, 21 Sep 2026 08:04:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789977857; cv=none; b=ir3lYcsyxy3vRNUiEO4p44RVY10tNrOLVNLsWYurH2ck76WcwAUkv5yqB8UPMjOvPzb4lYtphwXs5QXtWWsy9QKpWAYdxnldmumiTXz3LJjVtIM5iw+sbBwunUBBXGJt/enahsjS8Ek42pESQpf33tsx1jV1QaRlECn4RCQqsBQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789977857; c=relaxed/simple; bh=2+MPneEC8c6gMfIIvCxJ05wEMHIdcFqJRHelEWlO9qE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=YDDSHm4mhPmaz6EJd8e/EZVvRpW4UnVeU/szgN8zv53z4eLvEiAU2Vq7wewgJJb2U0tM+rghz+/ubCtnpI3pWAI0BnIHuA4hkNkASlTtWtLC74Ga9VgKgUrNyi96ooW/BJueO1f8RvUS/r5Mtk6hSwoE7EUSFlo0HZfSCALeatk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=FrFzVX6H; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="FrFzVX6H" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=xv+EVXdkYcjZnUBkDlxkGt1+yajUwqqEUYIuSmBmRUg=; b=FrFzVX6HxZQlXWZzst69uTPQ4CoYdrR4RdJqw3WxYNMxdju+kUq/iQ8tu23hvkTqOPFlzRGA2 0aAnLPM4O4adq4z2MeqRbrdIRSA6g7LCISauc6e09xU4O1FgqmRNO3VTZdajFfofRESq6Khzwe/ eGYZgE/3MOMuRH2BwlizVec= Received: from mail.maildlp.com (unknown [172.19.162.144]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4hpFnD3SDXzpSvD; Mon, 21 Sep 2026 15:52:16 +0800 (CST) Received: from kwepemf100015.china.huawei.com (unknown [7.202.181.14]) by mail.maildlp.com (Postfix) with ESMTPS id BFDBA40538; Mon, 21 Sep 2026 16:04:10 +0800 (CST) Received: from dggphicprd10024.huawei.com (10.243.6.112) by kwepemf100015.china.huawei.com (7.202.181.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 21 Sep 2026 16:04:09 +0800 From: Abbott Liu To: , , , , , , , , , , , , CC: , , , , Subject: [PATCH v5 1/3] RAS: Fix inverted context info bounds check in ARM processor errors Date: Mon, 21 Sep 2026 16:03:35 +0800 Message-ID: <20260921080337.3000957-2-liuwenliang@huawei.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260921080337.3000957-1-liuwenliang@huawei.com> References: <20260921080337.3000957-1-liuwenliang@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500001.china.huawei.com (7.221.188.70) To kwepemf100015.china.huawei.com (7.202.181.14) Content-Type: text/plain; charset="utf-8" Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory") added bounds checks for malformed ARM processor error records but contained a bug: In log_arm_hw_error(), the ctx_info bounds check is inverted. The condition "sz + (long)ctx_info - (long)err >=3D err->section_length" adds ctx_info->size when the context header is already past the end of the section instead of when it is within bounds. So change the comparison to <=3D. Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocat= ed memory") Signed-off-by: Abbott Liu Reviewed-by: Hanjun Guo --- drivers/ras/ras.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 03df3db62334..2540538a16a8 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, cons= t u8 sev) for (n =3D 0; n < err->context_info_num; n++) { sz =3D sizeof(struct cper_arm_ctx_info); =20 - if (sz + (long)ctx_info - (long)err >=3D err->section_length) + if (sz + (long)ctx_info - (long)err <=3D err->section_length) sz +=3D ctx_info->size; =20 ctx_info =3D (struct cper_arm_ctx_info *)((long)ctx_info + sz); --=20 2.43.0 From nobody Thu Sep 24 20:37:27 2026 Received: from canpmsgout12.his.huawei.com (canpmsgout12.his.huawei.com [113.46.200.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB91345041A; Mon, 21 Sep 2026 08:04:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789977863; cv=none; b=u8J9ccXtsaLQ3H1XQZdLiAdTQrlqhsCY5SrJ0grxB7F8fSDnw6NOeQrPB9LzzAVRMvfvz3MKS//NlZ6OgBTi3UOBbIU7Id8mf90YlTfWV5CpEQMy60QW/ysArc2XCycFmfBaaDdavcXIM/jsL4jQk8X2VLhBnqePeg4+kK3CzPM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789977863; c=relaxed/simple; bh=ctxsi4K3jhdYPETBNpeycBJxIsBVH+gMJj5n6DNzq30=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lKyy++IqWoIedg5qmQ/l8gKOl3mGmr+45iGwGN7VcvHGERYlalkd1LUeK0PzacR0U0vbFtq0PP0bw4/OmadhKRMd+ZxshUES/MYySytVz11hI8+h3eI0Owv/UYwz+MinMFqTzw8wSpSRLewLx9UrNEa6unnL60hFJdmD795t1wc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=50Sb9D39; arc=none smtp.client-ip=113.46.200.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="50Sb9D39" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=AGMOgDnjn0bT3s1dxuqcJ7m7Fndb2GHS1+lbjuUfUu8=; b=50Sb9D39MVQZ/zEj7KM69SrN+kfRa4aUEDFIpVktde/8+MZjb7XFGElApjvnlP0neF51CYLad Gdu/E1NwO4Q9MZHzw2BkO6pt8WYNVKAwMb0TJOZs0B1WsWkZZEth/oCy6c0ngPnYIQBrOIPNyD4 llPwlBcN5U3I10xE5/A5pAM= Received: from mail.maildlp.com (unknown [172.19.163.200]) by canpmsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4hpFpF1LswznTZf; Mon, 21 Sep 2026 15:53:09 +0800 (CST) Received: from kwepemf100015.china.huawei.com (unknown [7.202.181.14]) by mail.maildlp.com (Postfix) with ESMTPS id 6B56540563; Mon, 21 Sep 2026 16:04:11 +0800 (CST) Received: from dggphicprd10024.huawei.com (10.243.6.112) by kwepemf100015.china.huawei.com (7.202.181.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 21 Sep 2026 16:04:10 +0800 From: Abbott Liu To: , , , , , , , , , , , , CC: , , , , Subject: [PATCH v5 2/3] RAS: Fix out-of-bounds read when tracing arm_event Date: Mon, 21 Sep 2026 16:03:36 +0800 Message-ID: <20260921080337.3000957-3-liuwenliang@huawei.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260921080337.3000957-1-liuwenliang@huawei.com> References: <20260921080337.3000957-1-liuwenliang@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500001.china.huawei.com (7.221.188.70) To kwepemf100015.china.huawei.com (7.202.181.14) Content-Type: text/plain; charset="utf-8" The vsei_len < 0 error path did not verify the pei_len and ctx_len. When vsei_len is negative, section_length is too small to hold the full record, yet pei_len and ctx_len were derived from err_info_num/context_info_num and may describe regions beyond the (long)err .. err + section_length buffer. To prevent trace_arm_event from reading past the allocated record, sanitize the parameters: recalculate ctx_len and pei_len based on section_length, limit them, and set the corresponding pointers to NULL and lengths to 0 when there is no remaining space. pei_len and ctx_len become s32 so that the recalculated lengths can be checked for negative values. Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to use= rspace") Signed-off-by: Abbott Liu Reviewed-by: Hanjun Guo --- drivers/ras/ras.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 2540538a16a8..085fe2d980e5 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, co= nst u8 sev) struct cper_arm_err_info *err_info; struct cper_arm_ctx_info *ctx_info; u8 *ven_err_data; - u32 ctx_len =3D 0; + s32 ctx_len =3D 0; int n, sz, cpu; s32 vsei_len; - u32 pei_len; + s32 pei_len; u8 *pei_err, *ctx_err; =20 pei_len =3D sizeof(struct cper_arm_err_info) * err->err_info_num; @@ -87,14 +87,28 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, co= nst u8 sev) pr_warn(FW_BUG "section length is too small\n"); pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); vsei_len =3D 0; + ven_err_data =3D NULL; + + ctx_len =3D err->section_length - (sizeof(struct cper_sec_proc_arm) + pe= i_len); + if (ctx_len < 0) { + ctx_len =3D 0; + ctx_err =3D NULL; + + pei_len =3D err->section_length - sizeof(struct cper_sec_proc_arm); + if (pei_len < 0) { + pei_len =3D 0; + pei_err =3D NULL; + } + } + } else { + ven_err_data =3D (u8 *)ctx_info; } - ven_err_data =3D (u8 *)ctx_info; =20 cpu =3D GET_LOGICAL_INDEX(err->mpidr); if (cpu < 0) cpu =3D -1; =20 - trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len, + trace_arm_event(err, pei_err, (u32)pei_len, ctx_err, (u32)ctx_len, ven_err_data, (u32)vsei_len, sev, cpu); } =20 --=20 2.43.0 From nobody Thu Sep 24 20:37:27 2026 Received: from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com [113.46.200.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C7A8E40587A; Mon, 21 Sep 2026 08:04:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.223 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789977858; cv=none; b=D8H0dauFp/k51T9/l88gpqWqSEFaayHSykM21HIa2r0CM3hjyC9oNH11PqQP0YmeAPFyxN7GQD67r3N3KSuefkzQuNyGKfLVsS8KEKktZmpDCqi9QgmCfRBzyVhHfgB07ESO2U8bXExtXE1a1UxFKaVE+eYm2bn42BgUyncZIKk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789977858; c=relaxed/simple; bh=yBsoL+NufVEKS7kp8UCj4iZdfdLKNlK5/iZ3qWshcyI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=YkQJ3uoglKMp/QiawdjudM2wCd/mZ/3UBOHbsBUdkPJD74R7cPaESu2DSatnp5jPR8StXnRzluclhcPhJUQpgmo6M3qJoyMciU4RJNFKUMJ9PO3k8vHn9tVAflCa+gbdJm/cZN3OP6Gl4ehlDJKnC6KSZrJmVgufhf2cpcE98Wg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=PxjvXVIi; arc=none smtp.client-ip=113.46.200.223 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="PxjvXVIi" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=lX+q7Z79ZnFjPOSg3+i5vv9MV7dIo359XL+Dp/vbBpY=; b=PxjvXVIisk4iuXLf89WVQpvkaPBxhqLybFBzO4A6JQr0g1mojTDB06y0+V3wR8wldDDy6XEjG j9cDxnbOtzazzjngkvkHycamyzfcfaMk0BidrdazLI7dZB1St+/gBy2S7H1C3RGH3Q9YswvmigS znynPNevOCDMRSBz6RSxxDo= Received: from mail.maildlp.com (unknown [172.19.163.163]) by canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4hpFpG1JllzmV8f; Mon, 21 Sep 2026 15:53:10 +0800 (CST) Received: from kwepemf100015.china.huawei.com (unknown [7.202.181.14]) by mail.maildlp.com (Postfix) with ESMTPS id 15D3F4048B; Mon, 21 Sep 2026 16:04:12 +0800 (CST) Received: from dggphicprd10024.huawei.com (10.243.6.112) by kwepemf100015.china.huawei.com (7.202.181.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 21 Sep 2026 16:04:11 +0800 From: Abbott Liu To: , , , , , , , , , , , , CC: , , , , Subject: [PATCH v5 3/3] RAS: Fix integer overflow in ARM processor error context walk Date: Mon, 21 Sep 2026 16:03:37 +0800 Message-ID: <20260921080337.3000957-4-liuwenliang@huawei.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260921080337.3000957-1-liuwenliang@huawei.com> References: <20260921080337.3000957-1-liuwenliang@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500001.china.huawei.com (7.221.188.70) To kwepemf100015.china.huawei.com (7.202.181.14) Content-Type: text/plain; charset="utf-8" sz is an int while ctx_info->size is a u32, so a size greater than 0x7fffffff makes sz negative and moves ctx_info below the error record. The header check of the next iteration then passes, because the offset of ctx_info relative to err is negative, and ctx_info->size is read from a wild pointer. A negative sz also deflates ctx_len, which can keep vsei_len non-negative, so the truncated record path is not taken and the out-of-section ctx_info is traced as vendor error data. Check each context entry with 64-bit arithmetic: both the header and the context data must fit within err + section_length. Stop the walk at the first entry that does not fit, flag the record as overflowed and take the truncated record path, which sanitizes the values passed to trace_arm_event(), instead of detecting the overflow after the walk only from a negative vsei_len. Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocat= ed memory") Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information to use= rspace") Reported-by: Hanjun Guo Link: https://lore.kernel.org/all/20260825134323.4181892-1-liuwenliang@huaw= ei.com/ Signed-off-by: Abbott Liu --- drivers/ras/ras.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 085fe2d980e5..4de5c0f41524 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -59,6 +59,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, cons= t u8 sev) struct cper_arm_ctx_info *ctx_info; u8 *ven_err_data; s32 ctx_len =3D 0; + bool overflow =3D false; int n, sz, cpu; s32 vsei_len; s32 pei_len; @@ -74,15 +75,30 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, co= nst u8 sev) for (n =3D 0; n < err->context_info_num; n++) { sz =3D sizeof(struct cper_arm_ctx_info); =20 - if (sz + (long)ctx_info - (long)err <=3D err->section_length) + if ((sz + (long)ctx_info - (long)err <=3D err->section_length) && + ((u64)sz + ctx_info->size + ((long)ctx_info - (long)err) <=3D + err->section_length)) { sz +=3D ctx_info->size; + } else { + overflow =3D true; + break; + } =20 ctx_info =3D (struct cper_arm_ctx_info *)((long)ctx_info + sz); ctx_len +=3D sz; } =20 vsei_len =3D err->section_length - (sizeof(struct cper_sec_proc_arm) + pe= i_len + ctx_len); - if (vsei_len < 0) { + /* + * There are two cases: + * + * 1. When err->context_info_num <=3D 0, overflow is always false. In thi= s case, + * we use vsei_len to check whether section_length is too small. + * + * 2. When err->context_info_num > 0, overflow has already been set to tr= ue by + * the preceding for loop if section_length is too small. + */ + if (overflow || vsei_len < 0) { pr_warn(FW_BUG "section length: %d\n", err->section_length); pr_warn(FW_BUG "section length is too small\n"); pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); --=20 2.43.0