[PATCH v6 1/2] RAS: Fix inverted context info bounds check in ARM processor errors

[Abbott Liu]

Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
allocated memory") added bounds checks for malformed ARM processor
error records but contained a bug:

  In log_arm_hw_error(), the ctx_info bounds check is inverted. The
  condition "sz + (long)ctx_info - (long)err >= err->section_length"
  adds ctx_info->size when the context header is already past the end
  of the section instead of when it is within bounds. So change the
  comparison to <=.

The ctx_info->size overflow (a size over 0x7fffffff making the
signed sz negative) is deliberately left unaddressed: a size
overflow implies a corrupted firmware record, and then
section_length may be corrupted as well. For example, a real
section length of 1024 could be reported as 16000, and the context
walk can go out of bounds even without any size overflow. Guarding
ctx_info->size alone therefore does not add meaningful protection.

Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
Signed-off-by: Abbott Liu <liuwenliang@xxxxxxxxxx>
Reviewed-by: Hanjun Guo <guohanjun@xxxxxxxxxx>
---
 drivers/ras/ras.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 03df3db62334..2540538a16a8 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
 	for (n = 0; n < err->context_info_num; n++) {
 		sz = sizeof(struct cper_arm_ctx_info);
 
-		if (sz + (long)ctx_info - (long)err >= err->section_length)
+		if (sz + (long)ctx_info - (long)err <= err->section_length)
 			sz += ctx_info->size;
 
 		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
-- 
2.43.0