From: liutong <liutong@iscas.ac.cn>
To: opensbi@lists.infradead.org
Cc: Rahul Pathak <rahul@summations.net>, liutong <liutong@iscas.ac.cn>
Subject: [PATCH v2 1/6] lib: sbi_dbtr: fix integer overflow in read_trig bounds check
Date: Fri, 31 Jul 2026 10:34:00 +0000 [thread overview]
Message-ID: <20260731103405.1535818-2-liutong@iscas.ac.cn> (raw)
In-Reply-To: <20260731103405.1535818-1-liutong@iscas.ac.cn>
In sbi_dbtr_read_trig(), the range check is:
if (trig_idx_base + trig_count >= hs->total_trigs)
When trig_idx_base and trig_count are both unsigned long values supplied
by S-mode, their sum can wrap past ULONG_MAX to a small value, making
the check pass. For example trig_idx_base=1, trig_count=ULONG_MAX wraps
to 0, which is less than total_trigs.
This allows the subsequent for_each_trig_entry loop to access trigger
entries far beyond the triggers[] array, corrupting M-mode heap memory
via CSR read-back writes and leaking M-mode internal state to S-mode
shared memory.
Rewrite the condition as trig_count >= total_trigs - trig_idx_base. The
subtraction is safe because the preceding check already guarantees
trig_idx_base < total_trigs.
Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support")
Signed-off-by: liutong <liutong@iscas.ac.cn>
---
Previously sent as [PATCH].
Changes in v2:
- Added Fixes tag
- Consolidated into patch series
lib/sbi/sbi_dbtr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/sbi/sbi_dbtr.c b/lib/sbi/sbi_dbtr.c
index 01047969..eeab7d3a 100644
--- a/lib/sbi/sbi_dbtr.c
+++ b/lib/sbi/sbi_dbtr.c
@@ -572,7 +572,7 @@ int sbi_dbtr_read_trig(unsigned long smode,
return SBI_ERR_FAILED;
if (trig_idx_base >= hs->total_trigs ||
- trig_idx_base + trig_count >= hs->total_trigs)
+ trig_count >= hs->total_trigs - trig_idx_base)
return SBI_ERR_INVALID_PARAM;
if (sbi_dbtr_shmem_disabled(hs))
--
2.34.1
--
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi
next prev parent reply other threads:[~2026-07-31 10:34 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-31 10:33 [PATCH v2 0/6] Fix input validation issues in SBI ecall handlers liutong
2026-07-31 10:34 ` liutong [this message]
2026-09-03 7:54 ` [PATCH v2 1/6] lib: sbi_dbtr: fix integer overflow in read_trig bounds check Himanshu Chauhan
2026-07-31 10:34 ` [PATCH v2 2/6] lib: sbi_dbtr: fix shared memory double-fetch in install_trig liutong
2026-09-03 8:49 ` Himanshu Chauhan
2026-07-31 10:34 ` [PATCH v2 3/6] lib: sbi_dbtr: use range check for shared memory domain validation liutong
2026-09-03 9:01 ` Himanshu Chauhan
2026-07-31 10:34 ` [PATCH v2 4/6] lib: sbi_pmu: fix integer overflow and zero-address in event_get_info liutong
2026-07-31 10:34 ` [PATCH v2 5/6] lib: sbi_sse: fix shared memory double-fetch in sse_write_attrs liutong
2026-09-03 9:07 ` Himanshu Chauhan
2026-07-31 10:34 ` [PATCH v2 6/6] lib: sbi_mpxy: fix integer overflow in attribute range endpoint liutong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731103405.1535818-2-liutong@iscas.ac.cn \
--to=liutong@iscas.ac.cn \
--cc=opensbi@lists.infradead.org \
--cc=rahul@summations.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox