Mirrors/opensbi
3
0 Fork 1
mirror of https://github.com/riscv-software-src/opensbi.git synced 2026-10-23 20:31:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

lib: utils/mailbox: Reject invalid RPMI queue indices

Browse Source 
The RPMI shared-memory helpers validate a queue index before using it
to select queue_ctx_tbl, but the current comparison accepts queue_id
equal to queue_count.

Only entries 0 through queue_count - 1 are initialized from the device
tree. Accepting queue_count can therefore use an uninitialized queue
context when a protocol operation selects a queue omitted by the
description.

Reject queue_id greater than or equal to queue_count in both transfer
directions.

Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260831130444.53629-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
This commit is contained in:
Pengpeng Hou authored and Anup Patel committed 2026-10-23 13:18:45 +05:30
1 parent 95c7980851
commit 9bc841226d
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
+2 -2
View File
@@ -316,7 +316,7 @@ static int smq_rx(struct rpmi_shmem_mbox_controller *mctl,
int ret, rxretry = 0;
struct smq_queue_ctx *qctx;
if (mctl->queue_count < queue_id) {
if (queue_id >= mctl->queue_count) {
sbi_printf("%s: invalid queue_id or service_group_id\n",
__func__);
return SBI_EINVAL;
@@ -351,7 +351,7 @@ static int smq_tx(struct rpmi_shmem_mbox_controller *mctl,
int ret, txretry = 0;
struct smq_queue_ctx *qctx;
if (mctl->queue_count < queue_id) {
if (queue_id >= mctl->queue_count) {
sbi_printf("%s: invalid queue_id or service_group_id\n",
__func__);
return SBI_EINVAL;