diff options
| author | Heinrich Schuchardt <[email protected]> | 2023-11-17 14:59:31 +0100 |
|---|---|---|
| committer | Anup Patel <[email protected]> | 2023-11-22 20:55:22 +0530 |
| commit | 574b9c8ec22e742e63b6204ad43916c54fc49eba (patch) | |
| tree | 0f0ae9da7e5b2504dd12d9e3719a0d39dced6d33 | |
| parent | 16bb9305338b4ae87d95ce776cf029accf07bc49 (diff) | |
lib: sbi_pmu: avoid buffer overflow
total_ctrs is bounded by
SBI_PMU_FW_CTR_MAX + SBI_PMU_HW_CTR_MAX) == 48
which exceeds BITS_PER_LONG on 32 bit systems.
Iterating over the bits of &cmask results in a buffer overflow when looking
for a bit >= BITS_PER_LONG.
Adjust the iterators in sbi_pmu_ctr_start() and sbi_pmu_ctr_stop()
accordingly.
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
| -rw-r--r-- | lib/sbi/sbi_pmu.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/sbi/sbi_pmu.c b/lib/sbi/sbi_pmu.c index f4c8fc4c..185068bb 100644 --- a/lib/sbi/sbi_pmu.c +++ b/lib/sbi/sbi_pmu.c @@ -445,7 +445,7 @@ int sbi_pmu_ctr_start(unsigned long cbase, unsigned long cmask, if (flags & SBI_PMU_START_FLAG_SET_INIT_VALUE) bUpdate = true; - for_each_set_bit(i, &cmask, total_ctrs) { + for_each_set_bit(i, &cmask, BITS_PER_LONG) { cidx = i + cbase; event_idx_type = pmu_ctr_validate(phs, cidx, &event_code); if (event_idx_type < 0) @@ -540,7 +540,7 @@ int sbi_pmu_ctr_stop(unsigned long cbase, unsigned long cmask, if ((cbase + sbi_fls(cmask)) >= total_ctrs) return SBI_EINVAL; - for_each_set_bit(i, &cmask, total_ctrs) { + for_each_set_bit(i, &cmask, BITS_PER_LONG) { cidx = i + cbase; event_idx_type = pmu_ctr_validate(phs, cidx, &event_code); if (event_idx_type < 0) |