diff options
| author | Samuel Holland <samuel@sholland.org> | 2022-12-27 21:44:44 +0300 |
|---|---|---|
| committer | Anup Patel <anup@brainfault.org> | 2023-01-13 15:09:42 +0300 |
| commit | da5594bf853d9c635aee14bce3abc1076641e395 (patch) | |
| tree | 49fd8fe3712f199c5635f062b221d7398131e263 /platform | |
| parent | 001106d19b21cd6443ae7f7f6d4d048d80e9ecac (diff) | |
| download | opensbi-da5594bf853d9c635aee14bce3abc1076641e395.tar.xz | |
platform: generic: allwinner: Fix PLIC array bounds
The two referenced commits passed incorrect bounds to the PLIC save/
restore functions, causing out-of-bounds memory access. The functions
expect "num" to be the 1-based number of interrupt sources, equivalent
to the "riscv,ndev" devicetree property. Thus, "num" must be strictly
smaller than the 0-based size of the array storing the register values.
However, the referenced commits incorrectly passed in the unmodified
size of the array as "num". Fix this by reducing PLIC_SOURCES (matching
"riscv,ndev" on this platform), while keeping the same array sizes.
Addresses-Coverity-ID: 1530251 ("Out-of-bounds access")
Addresses-Coverity-ID: 1530252 ("Out-of-bounds access")
Fixes: 8509e46ca63a ("lib: utils/irqchip: plic: Ensure no out-of-bound access in priority save/restore helpers")
Fixes: 9a2eeb4aaeac ("lib: utils/irqchip: plic: Ensure no out-of-bound access in context save/restore helpers")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Anup Patel <anup@brainfault.org>
Diffstat (limited to 'platform')
| -rw-r--r-- | platform/generic/allwinner/sun20i-d1.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/platform/generic/allwinner/sun20i-d1.c b/platform/generic/allwinner/sun20i-d1.c index 1da9e5b..e2b76a3 100644 --- a/platform/generic/allwinner/sun20i-d1.c +++ b/platform/generic/allwinner/sun20i-d1.c @@ -69,10 +69,10 @@ static void sun20i_d1_csr_restore(void) * PLIC */ -#define PLIC_SOURCES 176 -#define PLIC_IE_WORDS ((PLIC_SOURCES + 31) / 32) +#define PLIC_SOURCES 175 +#define PLIC_IE_WORDS (PLIC_SOURCES / 32 + 1) -static u8 plic_priority[PLIC_SOURCES]; +static u8 plic_priority[1 + PLIC_SOURCES]; static u32 plic_sie[PLIC_IE_WORDS]; static u32 plic_threshold; |