Re: [PATCH v2 2/2] RAS: Fix out-of-bounds read when tracing arm_event

[Liuwenliang (Abbott Liu)]

Hi Hanjun, Thinks for your review.

>On 2026/8/25 21:43, Abbott Liu wrote:
>> The vsei_len < 0 error path did not verify the pei_len and ctx_len.
>> When vsei_len is negative, section_length is too small to hold the 
>> full record, yet pei_len and ctx_len were derived from 
>> err_info_num/context_info_num and may describe regions beyond the 
>> (long)err .. err + section_length buffer. To prevent trace_arm_event 
>> from reading past the allocated record, sanitize the parameters:
>> move the cpu lookup above this path so it is available for tracing, 
>> recalculate ctx_len and pei_len based on section_length, limit them, 
>> set the corresponding pointers to NULL and lengths to 0  when there is 
>> no remaining space.
>> 
>> pei_len and ctx_len become s32 so that the recalculated lengths can be 
>> checked for negative values, and the cpu lookup is moved above the 
>> section length checks so that both paths can share the final
>> trace_arm_event() call.
>> 
>> Fixes: 05954511b73e ("RAS: Report all ARM processor CPER information 
>> to userspace")
>> 
>
>Same here, no empty line between Fixes and Signed-off-by.

I am very sorry for making such a basic mistake; this issue will be resolved
in the next version.

>
>> Signed-off-by: Abbott Liu <liuwenliang@xxxxxxxxxx>
>> ---
>>   drivers/ras/ras.c | 31 +++++++++++++++++++++----------
>>   1 file changed, 21 insertions(+), 10 deletions(-)
>> 
>> diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 
>> 2540538a16a8..4a48a897f616 100644
>> --- a/drivers/ras/ras.c
>> +++ b/drivers/ras/ras.c
>> @@ -58,10 +58,10 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>>   	struct cper_arm_err_info *err_info;
>>   	struct cper_arm_ctx_info *ctx_info;
>>   	u8 *ven_err_data;
>> -	u32 ctx_len = 0;
>> +	s32 ctx_len = 0;
>>   	int n, sz, cpu;
>>   	s32 vsei_len;
>> -	u32 pei_len;
>> +	s32 pei_len;
>>   	u8 *pei_err, *ctx_err;
>>   
>>   	pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num; @@ 
>> -81,20 +81,31 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
>>   		ctx_len += sz;
>>   	}
>>   
>> +	cpu = GET_LOGICAL_INDEX(err->mpidr);
>> +	if (cpu < 0)
>> +		cpu = -1;
>> +
>>   	vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
>>   	if (vsei_len < 0) {
>>   		pr_warn(FW_BUG "section length: %d\n", err->section_length);
>>   		pr_warn(FW_BUG "section length is too small\n");
>>   		pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
>>   		vsei_len = 0;
>> -	}
>> -	ven_err_data = (u8 *)ctx_info;
>> -
>> -	cpu = GET_LOGICAL_INDEX(err->mpidr);
>> -	if (cpu < 0)
>> -		cpu = -1;
>> -
>> -	trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
>> +		ven_err_data = NULL;
>> +		ctx_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len);
>> +		if (ctx_len < 0) {
>> +			ctx_len = 0;
>> +			ctx_err = NULL;
>> +			pei_len = err->section_length - sizeof(struct cper_sec_proc_arm);
>> +			if (pei_len < 0) {
>> +				pei_len = 0;
>> +				pei_err = NULL;
>> +			}
>> +		}
>> +	} else
>> +		ven_err_data = (u8 *)ctx_info;
>
>else {
>	ven_err_data = (u8 *)ctx_info;
>}
>

This issue will be resolved in next version.

>Thanks
>Hanjun
>