From 95c7980851171ef7b0fd909214ec5838f34ee12d Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Fri, 28 Aug 2026 22:25:01 +0800 Subject: [PATCH] lib: utils/mailbox: reject undersized RPMI shmem queues The RPMI shared-memory mailbox transport derives qctx->num_slots from the device-tree queue window size and the riscv,slot-size property. The current initialization only checks that the queue window is nonzero before subtracting the two RPMI header slots. Reject queue windows that cannot provide the two header slots plus at least two data ring slots. A zero data-slot count would later be used as a modulo divisor, and a one-slot ring is also unusable with the current full/empty convention because one empty slot is reserved to distinguish the two states. Also reject data-slot counts that cannot be represented by qctx->num_slots. Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support") Signed-off-by: Pengpeng Hou Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260828142521.14267-1-pengpeng@iscas.ac.cn Signed-off-by: Anup Patel --- lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c index cf975658..ecac100f 100644 --- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c +++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c @@ -592,7 +592,7 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl, const char *name; const fdt32_t *prop; int count, len, ret, qid; - uint64_t reg_addr, reg_size; + uint64_t reg_addr, reg_size, total_slots; struct smq_queue_ctx *qctx; ret = fdt_node_check_compatible(fdt, nodeoff, @@ -642,6 +642,13 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl, if (ret < 0 || !reg_addr || !reg_size) return SBI_ENOENT; + /* calculate number of slots in each queue */ + total_slots = reg_size / mctl->slot_size; + if (total_slots < RPMI_QUEUE_HEADER_SLOTS + 2 || + total_slots - RPMI_QUEUE_HEADER_SLOTS > (u32)-1) + return SBI_EINVAL; + qctx->num_slots = total_slots - RPMI_QUEUE_HEADER_SLOTS; + ret = sbi_domain_root_add_memrange(reg_addr, reg_size, reg_size, (SBI_DOMAIN_MEMREGION_MMIO | SBI_DOMAIN_MEMREGION_M_READABLE | @@ -649,10 +656,6 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl, if (ret) return ret; - /* calculate number of slots in each queue */ - qctx->num_slots = - (reg_size - (mctl->slot_size * RPMI_QUEUE_HEADER_SLOTS)) / mctl->slot_size; - /* setup queue pointers */ qctx->headptr = ((void *)(unsigned long)reg_addr) + RPMI_QUEUE_HEAD_SLOT * mctl->slot_size;