diff options
| author | Alexander Chuprunov <[email protected]> | 2025-09-18 12:07:06 +0300 |
|---|---|---|
| committer | Anup Patel <[email protected]> | 2025-10-27 16:59:42 +0530 |
| commit | ac16c6b604961525bb096c0513c6ad4dbf5a5695 (patch) | |
| tree | 6ab3b1b1fd585a6811c8dfd626a0ca84f8771010 | |
| parent | 63aacbd7826c539a46c108d0e055db57cb335eb2 (diff) | |
lib: sbi: sbi_pmu: added checks for ctr_idx in match
Previously, in sbi_pmu_ctr_cfg_match() function, ctr_idx was used immediately
after pmu_ctr_find_fw() or pmu_ctr_find_hw() calls. In first case, array index
was (ctr_idx - num_hw_ctrs), in second - ctr_idx. But pmu_ctr_find_fw() and
pmu_ctr_find_hw() functions can return negative value, in which case writing
in arrays with such indexes would corrupt sbi_pmu_hart_state structure.
To avoid this situation, direct ctr_idx value check added.
Signed-off-by: Alexander Chuprunov <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
| -rw-r--r-- | lib/sbi/sbi_pmu.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/lib/sbi/sbi_pmu.c b/lib/sbi/sbi_pmu.c index b618be43..70c49abc 100644 --- a/lib/sbi/sbi_pmu.c +++ b/lib/sbi/sbi_pmu.c @@ -830,7 +830,7 @@ static int pmu_ctr_find_fw(struct sbi_pmu_hart_state *phs, cidx = i + cbase; if (cidx < num_hw_ctrs || total_ctrs <= cidx) continue; - if (phs->active_events[i] != SBI_PMU_EVENT_IDX_INVALID) + if (phs->active_events[cidx] != SBI_PMU_EVENT_IDX_INVALID) continue; if (SBI_PMU_FW_PLATFORM == event_code && pmu_dev && pmu_dev->fw_counter_match_encoding) { @@ -840,7 +840,7 @@ static int pmu_ctr_find_fw(struct sbi_pmu_hart_state *phs, continue; } - return i; + return cidx; } return SBI_ENOTSUPP; @@ -886,13 +886,14 @@ int sbi_pmu_ctr_cfg_match(unsigned long cidx_base, unsigned long cidx_mask, /* Any firmware counter can be used track any firmware event */ ctr_idx = pmu_ctr_find_fw(phs, cidx_base, cidx_mask, event_code, event_data); - if (event_code == SBI_PMU_FW_PLATFORM) + if ((event_code == SBI_PMU_FW_PLATFORM) && (ctr_idx >= num_hw_ctrs)) phs->fw_counters_data[ctr_idx - num_hw_ctrs] = event_data; } else { ctr_idx = pmu_ctr_find_hw(phs, cidx_base, cidx_mask, flags, event_idx, event_data); - phs->hw_counters_data[ctr_idx] = event_data; + if (ctr_idx >= 0) + phs->hw_counters_data[ctr_idx] = event_data; } if (ctr_idx < 0) |