diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2023-05-29 11:27:20 +0200 |
|---|---|---|
| committer | Anup Patel <anup@brainfault.org> | 2023-06-04 15:13:50 +0530 |
| commit | df75e0995689842b3022a4a8d4d69e980430c129 (patch) | |
| tree | 71fb382aebbb67e2a1ead6951bde839ce464b8a1 | |
| parent | 122f2260b350e94e4e79439ea289f08a329eb14a (diff) | |
| download | opensbi-df75e0995689842b3022a4a8d4d69e980430c129.tar.gz opensbi-df75e0995689842b3022a4a8d4d69e980430c129.zip | |
lib: utils/ipi: buffer overrun aclint_mswi_cold_init
The parameter checks in aclint_mswi_cold_init() don't guard against a
buffer overrun.
mswi_hartid2data is defined as an array of SBI_HARTMASK_MAX_BITS entries.
The current check allows
mswi->hart_count = ACLINT_MSWI_MAX_HARTS
mswi->first_hartid = SBI_HARTMASK_MAX_BITS - 1.
With these values mswi_hartid2data will be accessed at index
SBI_HARTMASK_MAX_BITS + SBI_HARTMASK_MAX_BITS - 2.
We have to check the sum of mswi->first_hartid and mswi->hart_count.
Furthermore mswi->hart_count = 0 would not make much sense.
Addresses-Coverity-ID: 1529705 ("Out-of-bounds write")
Fixes: 5a049fe1d6a5 ("lib: utils/ipi: Add ACLINT MSWI library")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Xiang W <wxjstz@126.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
| -rw-r--r-- | lib/utils/ipi/aclint_mswi.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/utils/ipi/aclint_mswi.c b/lib/utils/ipi/aclint_mswi.c index 6b004cb9..ac8570bc 100644 --- a/lib/utils/ipi/aclint_mswi.c +++ b/lib/utils/ipi/aclint_mswi.c @@ -75,8 +75,8 @@ int aclint_mswi_cold_init(struct aclint_mswi_data *mswi) /* Sanity checks */ if (!mswi || (mswi->addr & (ACLINT_MSWI_ALIGN - 1)) || (mswi->size < (mswi->hart_count * sizeof(u32))) || - (mswi->first_hartid >= SBI_HARTMASK_MAX_BITS) || - (mswi->hart_count > ACLINT_MSWI_MAX_HARTS)) + (mswi->first_hartid + mswi->hart_count > SBI_HARTMASK_MAX_BITS) || + (!mswi->hart_count || mswi->hart_count > ACLINT_MSWI_MAX_HARTS)) return SBI_EINVAL; /* Update MSWI hartid table */ |