Re: [PATCH v4 1/3] RAS: Fix inverted context info bounds check in ARM processor errors

[Liuwenliang (Abbott Liu)]

Hi Hanjun,

Thank you for the review.

On 2026/9/17 10:13, Hanjun Guo wrote:
> On 2026/9/9 19:28, Abbott Liu wrote:
> > Commit 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past
> > allocated memory") added bounds checks for malformed ARM processor
> > error records but contained a bug:
> >
> >    In log_arm_hw_error(), the ctx_info bounds check is inverted. The
> >    condition "sz + (long)ctx_info - (long)err >= err->section_length"
> >    adds ctx_info->size when the context header is already past the end
> >    of the section instead of when it is within bounds. So change the
> >    comparison to <=.
> >
> > Fixes: 87880af2d24e ("APEI/GHES: ARM processor Error: don't go past allocated memory")
> > Signed-off-by: Abbott Liu <liuwenliang@xxxxxxxxxx>
> > ---
> >   drivers/ras/ras.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
> > index 03df3db62334..2540538a16a8 100644
> > --- a/drivers/ras/ras.c
> > +++ b/drivers/ras/ras.c
> > @@ -74,7 +74,7 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
> >   	for (n = 0; n < err->context_info_num; n++) {
> >   		sz = sizeof(struct cper_arm_ctx_info);
> >
> > -		if (sz + (long)ctx_info - (long)err >= err->section_length)
> > +		if (sz + (long)ctx_info - (long)err <= err->section_length)
> >   			sz += ctx_info->size;
> >
> >   		ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
> >
>
> Reviewed-by: Hanjun Guo <guohanjun@xxxxxxxxxx>

Thanks, I will add your Reviewed-by tag in v5, there will be no code changes in
that version, so the tag remains valid.

>
> Thanks
> Hanjun