Re: [PATCH v2] ACPI: APEI: GHES: fix ARM section length accounting after header

[Rafael J. Wysocki (Intel)]

On Thu, Aug 6, 2026 at 3:10 AM <kensanya@xxxxxxx> wrote:
>
> From: TanZheng <tanzheng@xxxxxxxxxx>
>
> In ghes_handle_arm_hw_error(), after skipping the cper_sec_proc_arm
> header with (err + 1), the remaining length was reduced by sizeof(err)
> (pointer size) instead of sizeof(*err) (structure size).
>
> That overestimates the bytes left for cper_arm_err_info records and can
> let the parser read past the CPER section when err_info_num is large
> enough relative to error_data_length.
>
> Use sizeof(*err) so the length accounting matches the pointer advance
> and the earlier sizeof(*err) size check.
>
> Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: TanZheng <tanzheng@xxxxxxxxxx>
> Reviewed-by: Shuai Xue <xueshuai@xxxxxxxxxxxxxxxxx>
> ---
> v2:
> - add Cc: stable@xxxxxxxxxxxxxxx
>
>  drivers/acpi/apei/ghes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index 3236a3ce79d6..e6362da72d15 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c
> @@ -576,7 +576,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
>                 return false;
>
>         p = (char *)(err + 1);
> -       length -= sizeof(err);
> +       length -= sizeof(*err);
>
>         for (i = 0; i < err->err_info_num; i++) {
>                 struct cper_arm_err_info *err_info;
> --

Applied as 7.3 material, thanks!