diff options
| author | Heinrich Schuchardt <[email protected]> | 2023-05-29 11:27:20 +0200 |
|---|---|---|
| committer | Anup Patel <[email protected]> | 2023-06-04 15:13:50 +0530 |
| commit | df75e0995689842b3022a4a8d4d69e980430c129 (patch) | |
| tree | 71fb382aebbb67e2a1ead6951bde839ce464b8a1 /include | |
| parent | 122f2260b350e94e4e79439ea289f08a329eb14a (diff) | |
lib: utils/ipi: buffer overrun aclint_mswi_cold_init
The parameter checks in aclint_mswi_cold_init() don't guard against a
buffer overrun.
mswi_hartid2data is defined as an array of SBI_HARTMASK_MAX_BITS entries.
The current check allows
mswi->hart_count = ACLINT_MSWI_MAX_HARTS
mswi->first_hartid = SBI_HARTMASK_MAX_BITS - 1.
With these values mswi_hartid2data will be accessed at index
SBI_HARTMASK_MAX_BITS + SBI_HARTMASK_MAX_BITS - 2.
We have to check the sum of mswi->first_hartid and mswi->hart_count.
Furthermore mswi->hart_count = 0 would not make much sense.
Addresses-Coverity-ID: 1529705 ("Out-of-bounds write")
Fixes: 5a049fe1d6a5 ("lib: utils/ipi: Add ACLINT MSWI library")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Xiang W <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions