mirror of
https://github.com/Fishwaldo/opensbi.git
synced 2025-03-15 19:31:32 +00:00
lib: utils/ipi: buffer overrun aclint_mswi_cold_init
The parameter checks in aclint_mswi_cold_init() don't guard against a
buffer overrun.
mswi_hartid2data is defined as an array of SBI_HARTMASK_MAX_BITS entries.
The current check allows
mswi->hart_count = ACLINT_MSWI_MAX_HARTS
mswi->first_hartid = SBI_HARTMASK_MAX_BITS - 1.
With these values mswi_hartid2data will be accessed at index
SBI_HARTMASK_MAX_BITS + SBI_HARTMASK_MAX_BITS - 2.
We have to check the sum of mswi->first_hartid and mswi->hart_count.
Furthermore mswi->hart_count = 0 would not make much sense.
Addresses-Coverity-ID: 1529705 ("Out-of-bounds write")
Fixes: 5a049fe1d6
("lib: utils/ipi: Add ACLINT MSWI library")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Xiang W <wxjstz@126.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
This commit is contained in:
parent
122f2260b3
commit
df75e09956
1 changed files with 2 additions and 2 deletions
|
@ -75,8 +75,8 @@ int aclint_mswi_cold_init(struct aclint_mswi_data *mswi)
|
|||
/* Sanity checks */
|
||||
if (!mswi || (mswi->addr & (ACLINT_MSWI_ALIGN - 1)) ||
|
||||
(mswi->size < (mswi->hart_count * sizeof(u32))) ||
|
||||
(mswi->first_hartid >= SBI_HARTMASK_MAX_BITS) ||
|
||||
(mswi->hart_count > ACLINT_MSWI_MAX_HARTS))
|
||||
(mswi->first_hartid + mswi->hart_count > SBI_HARTMASK_MAX_BITS) ||
|
||||
(!mswi->hart_count || mswi->hart_count > ACLINT_MSWI_MAX_HARTS))
|
||||
return SBI_EINVAL;
|
||||
|
||||
/* Update MSWI hartid table */
|
||||
|
|
Loading…
Add table
Reference in a new issue