mirror of
https://github.com/riscv-software-src/opensbi.git
synced 2026-10-23 20:31:14 +01:00
The RPMI shared-memory helpers validate a queue index before using it
to select queue_ctx_tbl, but the current comparison accepts queue_id
equal to queue_count.
Only entries 0 through queue_count - 1 are initialized from the device
tree. Accepting queue_count can therefore use an uninitialized queue
context when a protocol operation selects a queue omitted by the
description.
Reject queue_id greater than or equal to queue_count in both transfer
directions.
Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260831130444.53629-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>