[PATCH v6 0/2] RAS: Fix ARM processor error bounds checking

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") and commit 05954511b73e ("RAS: Report all ARM
processor CPER information to userspace") introduced bounds checking
for malformed ARM processor error records in log_arm_hw_error().
However, two issues remain:

1. The ctx_info bounds check condition is inverted: it adds
   ctx_info->size when the context header is already past the end of
   the section instead of when it is within bounds.

2. When vsei_len < 0, the error path does not verify pei_len and
   ctx_len. Since these are derived from err_info_num and
   context_info_num, they may describe regions beyond the allocated
   record, causing trace_arm_event() to read out of bounds.

Patch 1 fixes the inverted bounds check for context info iteration.
Patch 2 sanitizes pei_len/ctx_len/ven_err_data in the vsei_len < 0
error path to prevent out-of-bounds reads in trace_arm_event().

The ctx_info->size overflow (a size over 0x7fffffff making the signed
sz negative, as reported by Hanjun Guo) is deliberately left
unaddressed in this series: a size overflow implies a corrupted
firmware record, and then section_length may be corrupted as well.
For example, a real section length of 1024 could be reported as
16000, and the context walk can go out of bounds even without any
size overflow. Guarding ctx_info->size alone therefore does not add
meaningful protection.

Changes in v6:
  - Drop patch 3 ("RAS: Fix integer overflow in ARM processor error
    context walk"): an overflowing ctx_info->size implies a corrupted
    firmware record, in which case section_length may be corrupted as
    well, and the context walk can go out of bounds even without a
    size overflow, so guarding ctx_info->size alone does not add
    meaningful protection.
  - Add a note to the patch 1 commit message with the same
    reasoning, as cover letters are not preserved in git history.
  - No code changes in this version.

Changes in v5:
  - Collect Reviewed-by tags from Hanjun Guo for patches 1 and 2.
  - Added comments to patch 3.
  - No code changes in this version.

Changes in v4:
  - Remove the empty line between the Fixes: and Signed-off-by: tags
    in patches 1 and 2, per Hanjun Guo's comments.
  - Add braces around the else branch that assigns ven_err_data in
    patch 2, as suggested by Hanjun Guo.
  - Add new patch 3 to check each context entry with 64-bit
    arithmetic and stop the walk at the first entry that does not fit
    in the section, so a ctx_info->size over 0x7fffffff cannot
    overflow the signed int sz and walk ctx_info past the section,
    addressing Hanjun Guo's overflow comment.

Changes in v3:
  - There was no change, and the email was sent by mistake.

Changes in v2:
  - Split the original single patch into two separate patches, one
    for each distinct fix, to ease review and backporting.

v5:
  RAS: Fix ARM processor error bounds checking
  https://lore.kernel.org/all/20260921080337.3000957-1-liuwenliang@xxxxxxxxxx/

v4:
  RAS: Fix ARM processor error bounds checking
  https://lore.kernel.org/all/20260909112832.805314-1-liuwenliang@xxxxxxxxxx/

v2:
  RAS: Fix ARM processor error bounds checking
  https://lore.kernel.org/all/20260825134323.4181892-1-liuwenliang@xxxxxxxxxx/

v1:
  RAS: Fix out-of-range section_length in ARM processor error handling
  https://lore.kernel.org/all/20260820131829.1006371-1-liuwenliang@xxxxxxxxxx/

Abbott Liu (2):
  RAS: Fix inverted context info bounds check in ARM processor errors
  RAS: Fix out-of-bounds read when tracing arm_event

 drivers/ras/ras.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

-- 
2.43.0