Firmware/opensbi
8
0
Fork 0
forked from Mirrors/opensbi
Code Pull Requests Activity

platform: generic: allwinner: Fix PLIC array bounds

Browse Source 
The two referenced commits passed incorrect bounds to the PLIC save/
restore functions, causing out-of-bounds memory access. The functions
expect "num" to be the 1-based number of interrupt sources, equivalent
to the "riscv,ndev" devicetree property. Thus, "num" must be strictly
smaller than the 0-based size of the array storing the register values.

However, the referenced commits incorrectly passed in the unmodified
size of the array as "num". Fix this by reducing PLIC_SOURCES (matching
"riscv,ndev" on this platform), while keeping the same array sizes.

Addresses-Coverity-ID: 1530251 ("Out-of-bounds access")
Addresses-Coverity-ID: 1530252 ("Out-of-bounds access")
Fixes: 8509e46ca6 ("lib: utils/irqchip: plic: Ensure no out-of-bound access in priority save/restore helpers")
Fixes: 9a2eeb4aae ("lib: utils/irqchip: plic: Ensure no out-of-bound access in context save/restore helpers")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Anup Patel <anup@brainfault.org>
This commit is contained in:
Samuel Holland
2022-12-27 12:44:44 -06:00
committed by Anup Patel
parent 001106d19b
commit da5594bf85
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
platform/generic/allwinner/sun20i-d1.c
View File

@@ -69,10 +69,10 @@ static void sun20i_d1_csr_restore(void)
* PLIC
*/
#define PLIC_SOURCES 176
#define PLIC_IE_WORDS ((PLIC_SOURCES + 31) / 32)
#define PLIC_SOURCES 175
#define PLIC_IE_WORDS (PLIC_SOURCES / 32 + 1)
static u8 plic_priority[PLIC_SOURCES];
static u8 plic_priority[1 + PLIC_SOURCES];
static u32 plic_sie[PLIC_IE_WORDS];
static u32 plic_threshold;