diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2023-07-03 15:43:18 +0200 |
|---|---|---|
| committer | Anup Patel <anup@brainfault.org> | 2023-07-05 09:29:24 +0530 |
| commit | eb736a5118b8d271bd649d713b6a058882c8fb7b (patch) | |
| tree | de7daea62dee16619ba9c3c7f0d1752c3ea30411 | |
| parent | 0907de38dbcd121d2f8b4bafaf7f9fe76092d5f1 (diff) | |
| download | opensbi-eb736a5118b8d271bd649d713b6a058882c8fb7b.tar.gz opensbi-eb736a5118b8d271bd649d713b6a058882c8fb7b.zip | |
lib: sbi_pmu: Avoid out of bounds access
On a misconfigured system we could access phs->active_events[] out of
bounds. Check that num_hw_ctrs is less or equal SBI_PMU_HW_CTR_MAX.
Addresses-Coverity-ID: 1566113 ("Out-of-bounds read")
Addresses-Coverity-ID: 1566114 ("Out-of-bounds write")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
| -rw-r--r-- | lib/sbi/sbi_pmu.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/sbi/sbi_pmu.c b/lib/sbi/sbi_pmu.c index c73e6ef3..7213a53b 100644 --- a/lib/sbi/sbi_pmu.c +++ b/lib/sbi/sbi_pmu.c @@ -933,6 +933,8 @@ int sbi_pmu_init(struct sbi_scratch *scratch, bool cold_boot) /* mcycle & minstret is available always */ num_hw_ctrs = sbi_hart_mhpm_count(scratch) + 3; + if (num_hw_ctrs > SBI_PMU_HW_CTR_MAX) + return SBI_EINVAL; total_ctrs = num_hw_ctrs + SBI_PMU_FW_CTR_MAX; } |