Skip to content

events-arch-arm: check the payload length in the ampere, hisilicon and jaguarmicro decoders #265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
agenticode wants to merge 3 commits into
base: master
Choose a base branch
from
Open

events-arch-arm: check the payload length in the ampere, hisilicon and jaguarmicro decoders #265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
80496a2
non-standard-ampere: check the payload length before decoding
agenticode Sep 20, 2026
130aff5
non-standard-hisilicon: check the payload length before decoding
agenticode Sep 20, 2026
85a87a1
non-standard-jaguarmicro: check the payload length before decoding
agenticode Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 33 additions & 1 deletion events-arch-arm/non-standard-ampere.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -935,9 +935,16 @@ static int decode_amp_oem_type_error(struct ras_events *ras,
struct ras_non_standard_event *event)
{
struct db_desc_and_stmt *db;
int payload_type = PAYLOAD_TYPE(event->error[0]);
int payload_type;
int id = 0;

if (!event->error || !event->length) {
trace_seq_printf(s, "%s: empty payload\n", __func__);
return -1;
}

payload_type = PAYLOAD_TYPE(event->error[0]);

switch (payload_type) {
case PAYLOAD_TYPE_0:
db = &amp_payload0_event_db;
Expand Down Expand Up @@ -977,24 +984,44 @@ static int decode_amp_oem_type_error(struct ras_events *ras,
case PAYLOAD_TYPE_0: {
const struct amp_payload0_type_sec *err =
(struct amp_payload0_type_sec *)event->error;

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_amp_payload0_err_regs(ev_decoder, s, err);
break;
}
case PAYLOAD_TYPE_1: {
const struct amp_payload1_type_sec *err =
(struct amp_payload1_type_sec *)event->error;

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_amp_payload1_err_regs(ev_decoder, s, err);
break;
}
case PAYLOAD_TYPE_2: {
const struct amp_payload2_type_sec *err =
(struct amp_payload2_type_sec *)event->error;

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_amp_payload2_err_regs(ev_decoder, s, err);
break;
}
case PAYLOAD_TYPE_3: {
const struct amp_payload3_type_sec *err =
(struct amp_payload3_type_sec *)event->error;

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_amp_payload3_err_regs(ev_decoder, s, err);
break;
}
Expand All @@ -1013,6 +1040,11 @@ static struct ras_ns_ev_decoder amp_ns_oem_decoder[] = {
static void decode_amp_arm_vendor_data(struct trace_seq *s,
const uint8_t *buf, uint32_t length)
{
if (length < sizeof(struct amp_payload0_type_sec)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return;
}

decode_amp_payload0_err_regs(NULL, s,
(const struct amp_payload0_type_sec *)buf);
}
Expand Down
20 changes: 19 additions & 1 deletion events-arch-arm/non-standard-hisilicon.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,12 @@ static int decode_hisi_common_section(struct ras_events *ras,
(struct hisi_common_error_section *)event->error;
struct ras_stmt *stmt = hisi_common_section_db.stmt;
struct hisi_event hevent;
uint32_t avail;

if (!event->error || event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}

if (ras->record_events)
WARN_ONCE(!stmt, ALL, LOG_WARNING,
Expand All @@ -321,12 +327,24 @@ static int decode_hisi_common_section(struct ras_events *ras,
decode_hisi_common_section_hdr(stmt, err, &hevent);
trace_seq_printf(s, "%s\n", hevent.error_msg);

/*
* reg_array_size is firmware-supplied; only trust it as far as the
* bytes that were actually delivered.
*/
avail = (event->length - sizeof(*err)) / sizeof(err->reg_array[0]);

if (err->val_bits & BIT(HISI_COMMON_VALID_REG_ARRAY_SIZE) &&
err->reg_array_size > 0) {
unsigned int n = err->reg_array_size / sizeof(uint32_t);
unsigned int i;

if (n > avail) {
trace_seq_printf(s, "(truncated reg array)\n");
n = avail;
}

trace_seq_printf(s, "Register Dump:\n");
for (i = 0; i < err->reg_array_size / sizeof(uint32_t); i++) {
for (i = 0; i < n; i++) {
trace_seq_printf(s, "reg%02u=0x%08x\n", i,
err->reg_array[i]);
HISI_SNPRINTF(hevent.reg_msg, "reg%02u=0x%08x", i,
Expand Down
101 changes: 83 additions & 18 deletions events-arch-arm/non-standard-jaguarmicro.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,15 +562,31 @@ static void decode_jm_common_sec_head(struct ras_ns_ev_decoder *ev_decoder,

static void decode_jm_common_sec_tail(struct ras_ns_ev_decoder *ev_decoder,
const struct jm_common_sec_tail *err,
struct jm_event *event, uint32_t val_bits)
struct jm_event *event, uint32_t val_bits,
uint32_t tail_len)
{
uint32_t avail;

if (tail_len < sizeof(*err))
return;

/*
* reg_array_size comes from the firmware payload; only trust it as
* far as the bytes that were actually delivered.
*/
avail = (tail_len - sizeof(*err)) / sizeof(err->reg_array[0]);

if (val_bits & BIT(JM_COMMON_VALID_REG_ARRAY_SIZE) &&
err->reg_array_size > 0) {
int i;
uint32_t n = err->reg_array_size < avail ? err->reg_array_size : avail;
uint32_t i;

if (n < err->reg_array_size)
JM_SNPRINTF(event->reg_msg, "(truncated reg array)");

JM_SNPRINTF(event->reg_msg, "Extended Register Dump:");
JM_SNPRINTF(event->reg_msg, "[");
for (i = 0; i < err->reg_array_size; i++) {
for (i = 0; i < n; i++) {
JM_SNPRINTF(event->reg_msg, "reg%02d=0x%08x", i,
err->reg_array[i]);
}
Expand Down Expand Up @@ -622,7 +638,8 @@ static void record_jm_payload_err(const char *reg_str)
*/
static void decode_jm_payload0_err_regs(struct ras_ns_ev_decoder *ev_decoder,
struct trace_seq *s,
const struct jm_payload0_type_sec *err)
const struct jm_payload0_type_sec *err,
uint32_t length)
{
int i = 0;

Expand Down Expand Up @@ -699,7 +716,10 @@ static void decode_jm_payload0_err_regs(struct ras_ns_ev_decoder *ev_decoder,
JM_SNPRINTF(jmevent.reg_msg, "]");

trace_seq_printf(s, "Register Dump:");
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent, common_head->val_bits);
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent,
common_head->val_bits,
length - (uint32_t)((const char *)common_tail -
(const char *)err));

record_jm_payload_err(jmevent.reg_msg);

Expand All @@ -709,7 +729,8 @@ static void decode_jm_payload0_err_regs(struct ras_ns_ev_decoder *ev_decoder,
/* decode JaguarMicro specific error payload type 1 and save to database */
static void decode_jm_payload1_err_regs(struct ras_ns_ev_decoder *ev_decoder,
struct trace_seq *s,
const struct jm_payload1_type_sec *err)
const struct jm_payload1_type_sec *err,
uint32_t length)
{
int i = 0;

Expand Down Expand Up @@ -746,7 +767,10 @@ static void decode_jm_payload1_err_regs(struct ras_ns_ev_decoder *ev_decoder,
JM_SNPRINTF(jmevent.reg_msg, "]");

trace_seq_printf(s, "Register Dump:");
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent, common_head->val_bits);
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent,
common_head->val_bits,
length - (uint32_t)((const char *)common_tail -
(const char *)err));

record_jm_payload_err(jmevent.reg_msg);

Expand All @@ -756,7 +780,8 @@ static void decode_jm_payload1_err_regs(struct ras_ns_ev_decoder *ev_decoder,
/* decode JaguarMicro specific error payload type 2 and save to database */
static void decode_jm_payload2_err_regs(struct ras_ns_ev_decoder *ev_decoder,
struct trace_seq *s,
const struct jm_payload2_type_sec *err)
const struct jm_payload2_type_sec *err,
uint32_t length)
{
int i = 0;

Expand Down Expand Up @@ -789,7 +814,10 @@ static void decode_jm_payload2_err_regs(struct ras_ns_ev_decoder *ev_decoder,
JM_SNPRINTF(jmevent.reg_msg, "]");

trace_seq_printf(s, "Register Dump:");
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent, common_head->val_bits);
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent,
common_head->val_bits,
length - (uint32_t)((const char *)common_tail -
(const char *)err));

record_jm_payload_err(jmevent.reg_msg);

Expand All @@ -799,7 +827,8 @@ static void decode_jm_payload2_err_regs(struct ras_ns_ev_decoder *ev_decoder,
/* decode JaguarMicro specific error payload type 5 and save to database */
static void decode_jm_payload5_err_regs(struct ras_ns_ev_decoder *ev_decoder,
struct trace_seq *s,
const struct jm_payload5_type_sec *err)
const struct jm_payload5_type_sec *err,
uint32_t length)
{
int i = 0;

Expand Down Expand Up @@ -872,7 +901,10 @@ static void decode_jm_payload5_err_regs(struct ras_ns_ev_decoder *ev_decoder,
JM_SNPRINTF(jmevent.reg_msg, "]");

trace_seq_printf(s, "Register Dump:");
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent, common_head->val_bits);
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent,
common_head->val_bits,
length - (uint32_t)((const char *)common_tail -
(const char *)err));

record_jm_payload_err(jmevent.reg_msg);

Expand All @@ -882,7 +914,8 @@ static void decode_jm_payload5_err_regs(struct ras_ns_ev_decoder *ev_decoder,
/* decode JaguarMicro specific error payload type 6 and save to database */
static void decode_jm_payload6_err_regs(struct ras_ns_ev_decoder *ev_decoder,
struct trace_seq *s,
const struct jm_payload6_type_sec *err)
const struct jm_payload6_type_sec *err,
uint32_t length)
{
int i = 0;

Expand Down Expand Up @@ -934,7 +967,9 @@ static void decode_jm_payload6_err_regs(struct ras_ns_ev_decoder *ev_decoder,

trace_seq_printf(s, "Register Dump:");
decode_jm_common_sec_tail(ev_decoder, common_tail, &jmevent,
common_head->val_bits);
common_head->val_bits,
length - (uint32_t)((const char *)common_tail -
(const char *)err));

record_jm_payload_err(jmevent.reg_msg);
trace_seq_printf(s, "%s", jmevent.reg_msg);
Expand All @@ -950,6 +985,11 @@ static int decode_jm_oem_type_error(struct ras_events *ras,
int id = JM_PAYLOAD_FIELD_TIMESTAMP;
struct ras_stmt *stmt = jm_payload0_event_db.stmt;

if (!event->error || !event->length) {
trace_seq_printf(s, "%s: empty payload\n", __func__);
return -1;
}

WARN_ONCE(ras->record_events && !stmt, ALL, LOG_WARNING,
"Can't insert into table %s: no statement\n",
jm_payload0_event_db.desc->name);
Expand All @@ -959,23 +999,48 @@ static int decode_jm_oem_type_error(struct ras_events *ras,
if (payload_type == PAYLOAD_TYPE_0) {
const struct jm_payload0_type_sec *err =
(struct jm_payload0_type_sec *)event->error;
decode_jm_payload0_err_regs(ev_decoder, s, err);

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_jm_payload0_err_regs(ev_decoder, s, err, event->length);
} else if (payload_type == PAYLOAD_TYPE_1) {
const struct jm_payload1_type_sec *err =
(struct jm_payload1_type_sec *)event->error;
decode_jm_payload1_err_regs(ev_decoder, s, err);

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_jm_payload1_err_regs(ev_decoder, s, err, event->length);
} else if (payload_type == PAYLOAD_TYPE_2) {
const struct jm_payload2_type_sec *err =
(struct jm_payload2_type_sec *)event->error;
decode_jm_payload2_err_regs(ev_decoder, s, err);

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_jm_payload2_err_regs(ev_decoder, s, err, event->length);
} else if (payload_type == PAYLOAD_TYPE_5) {
const struct jm_payload5_type_sec *err =
(struct jm_payload5_type_sec *)event->error;
decode_jm_payload5_err_regs(ev_decoder, s, err);

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_jm_payload5_err_regs(ev_decoder, s, err, event->length);
} else if (payload_type == PAYLOAD_TYPE_6) {
const struct jm_payload6_type_sec *err =
(struct jm_payload6_type_sec *)event->error;
decode_jm_payload6_err_regs(ev_decoder, s, err);

if (event->length < sizeof(*err)) {
trace_seq_printf(s, "%s: truncated payload\n", __func__);
return -1;
}
decode_jm_payload6_err_regs(ev_decoder, s, err, event->length);
} else {
trace_seq_printf(s, "%s : wrong payload type\n", __func__);
log(TERM, LOG_ERR, "%s : wrong payload type\n", __func__);
Expand Down
Loading