GitHub-Mirror/opensbi
2
0
Fork 0
mirror of https://github.com/Fishwaldo/opensbi.git synced 2025-03-15 19:31:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

lib: sbi_pmu: avoid buffer overflow

Browse source 
total_ctrs is bounded by

    SBI_PMU_FW_CTR_MAX + SBI_PMU_HW_CTR_MAX) == 48

which exceeds BITS_PER_LONG on 32 bit systems.

Iterating over the bits of &cmask results in a buffer overflow when looking
for a bit >= BITS_PER_LONG.

Adjust the iterators in sbi_pmu_ctr_start() and sbi_pmu_ctr_stop()
accordingly.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
This commit is contained in:
Heinrich Schuchardt 2023-11-17 14:59:31 +01:00 • committed by Anup Patel
parent 16bb930533
commit 574b9c8ec2
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/sbi/sbi_pmu.c
View file

@ -445,7 +445,7 @@ int sbi_pmu_ctr_start(unsigned long cbase, unsigned long cmask,
if (flags & SBI_PMU_START_FLAG_SET_INIT_VALUE)
bUpdate = true;
for_each_set_bit(i, &cmask, total_ctrs) {
for_each_set_bit(i, &cmask, BITS_PER_LONG) {
cidx = i + cbase;
event_idx_type = pmu_ctr_validate(phs, cidx, &event_code);
if (event_idx_type < 0)
@ -540,7 +540,7 @@ int sbi_pmu_ctr_stop(unsigned long cbase, unsigned long cmask,
if ((cbase + sbi_fls(cmask)) >= total_ctrs)
return SBI_EINVAL;
for_each_set_bit(i, &cmask, total_ctrs) {
for_each_set_bit(i, &cmask, BITS_PER_LONG) {
cidx = i + cbase;
event_idx_type = pmu_ctr_validate(phs, cidx, &event_code);
if (event_idx_type < 0)