lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 428/667] firmware: arm_scmi: Fix list protocols enumeration in the base protocol
    Date
    From: Cristian Marussi <cristian.marussi@arm.com>

    [ Upstream commit 8009120e0354a67068e920eb10dce532391361d0 ]

    While enumerating protocols implemented by the SCMI platform using
    BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is
    currently validated in an improper way since the check employs a sum
    between unsigned integers that could overflow and cause the check itself
    to be silently bypassed if the returned value 'loop_num_ret' is big
    enough.

    Fix the validation avoiding the addition.

    Link: https://lore.kernel.org/r/20220330150551.2573938-4-cristian.marussi@arm.com
    Fixes: b6f20ff8bd94 ("firmware: arm_scmi: add common infrastructure and support for base protocol")
    Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
    Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/firmware/arm_scmi/base.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c
    index f5219334fd3a..3fe172c03c24 100644
    --- a/drivers/firmware/arm_scmi/base.c
    +++ b/drivers/firmware/arm_scmi/base.c
    @@ -197,7 +197,7 @@ scmi_base_implementation_list_get(const struct scmi_protocol_handle *ph,
    break;

    loop_num_ret = le32_to_cpu(*num_ret);
    - if (tot_num_ret + loop_num_ret > MAX_PROTOCOLS_IMP) {
    + if (loop_num_ret > MAX_PROTOCOLS_IMP - tot_num_ret) {
    dev_err(dev, "No. of Protocol > MAX_PROTOCOLS_IMP");
    break;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-07 21:32    [W:4.050 / U:0.472 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site