[PATCH v2 0/2] efi/cper: bound processor record walks

[Pengpeng Hou]

ARM and IA32/X64 processor CPER sections use different record layouts,
so each patch now gives one layout a self-contained length proof.

The ARM parser already receives the section length, but narrows its
remaining-byte calculation to int and reads a context record's size before
proving that its fixed header remains. The IA32/X64 printer receives no
section length at all, so neither its fixed error-info records nor its
variable context records are bounded by the section.

Patch 1 fixes the ARM walk.  Patch 2 passes the IA32/X64 section length
to its printer and consumes every fixed and variable record from an
explicit remaining-byte count.

Changes since v1:
https://lore.kernel.org/all/20260706093158.80364-1-pengpeng@xxxxxxxxxxx/
- split ARM and IA32/X64 handling as requested by Ard Biesheuvel
- explain each record layout and the first unchecked read
- make the aligned variable-size calculations overflow-safe

Pengpeng Hou (2):
  efi/cper: validate ARM context headers before reading their size
  efi/cper: bound IA32/X64 processor record walks

 drivers/firmware/efi/cper-arm.c | 53 ++++++++++++++++++++++++++-------
 drivers/firmware/efi/cper-x86.c | 51 +++++++++++++++++++++++++++++++++++++--
 drivers/firmware/efi/cper.c     |  3 ++-
 include/linux/cper.h            |  3 ++-
 4 files changed, 93 insertions(+), 15 deletions(-)

base-commit: dac3e89a2c90c2feeb471e1f22a2512ad424b792
-- 
2.50.1 (Apple Git-155)