| Message ID | 20230913132227.823336-1-frolov@swemel.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] hw/cxl: Fix out of bound array access | expand |
On Wed, 13 Sep 2023 16:22:28 +0300 Dmitry Frolov <frolov@swemel.ru> wrote: > According to cxl_interleave_ways_enc(), > fw->num_targets is allowed to be up to 16. > This also corresponds to CXL specs. > So, the fw->target_hbs[] array is iterated from 0 to 15. > But it is staticaly declared of length 8. > Thus, out of bound array access may occur. > > Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from TYPE_PXB_DEV") > > Signed-off-by: Dmitry Frolov <frolov@swemel.ru> > --- > v2: assert added > --- > hw/cxl/cxl-host.c | 1 + > include/hw/cxl/cxl.h | 2 +- > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c > index 034c7805b3..fe9143409b 100644 > --- a/hw/cxl/cxl-host.c > +++ b/hw/cxl/cxl-host.c > @@ -33,6 +33,7 @@ static void cxl_fixed_memory_window_config(CXLState *cxl_state, > for (target = object->targets; target; target = target->next) { > fw->num_targets++; > } > + assert(fw->num_targets <= ARRAY_SIZE(fw->target_hbs)); Just incase it gets lost as I replied late to the v1 comment. This is both unnecessary and results in an assert for a case that would otherwise be a nice error message about unsupported number of interleave ways. Jonathan > > fw->enc_int_ways = cxl_interleave_ways_enc(fw->num_targets, errp); > if (*errp) { > diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h > index 56c9e7676e..4944725849 100644 > --- a/include/hw/cxl/cxl.h > +++ b/include/hw/cxl/cxl.h > @@ -29,7 +29,7 @@ typedef struct PXBCXLDev PXBCXLDev; > typedef struct CXLFixedWindow { > uint64_t size; > char **targets; > - PXBCXLDev *target_hbs[8]; > + PXBCXLDev *target_hbs[16]; > uint8_t num_targets; > uint8_t enc_int_ways; > uint8_t enc_int_gran;
diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c index 034c7805b3..fe9143409b 100644 --- a/hw/cxl/cxl-host.c +++ b/hw/cxl/cxl-host.c @@ -33,6 +33,7 @@ static void cxl_fixed_memory_window_config(CXLState *cxl_state, for (target = object->targets; target; target = target->next) { fw->num_targets++; } + assert(fw->num_targets <= ARRAY_SIZE(fw->target_hbs)); fw->enc_int_ways = cxl_interleave_ways_enc(fw->num_targets, errp); if (*errp) { diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h index 56c9e7676e..4944725849 100644 --- a/include/hw/cxl/cxl.h +++ b/include/hw/cxl/cxl.h @@ -29,7 +29,7 @@ typedef struct PXBCXLDev PXBCXLDev; typedef struct CXLFixedWindow { uint64_t size; char **targets; - PXBCXLDev *target_hbs[8]; + PXBCXLDev *target_hbs[16]; uint8_t num_targets; uint8_t enc_int_ways; uint8_t enc_int_gran;
According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up to 16. This also corresponds to CXL specs. So, the fw->target_hbs[] array is iterated from 0 to 15. But it is staticaly declared of length 8. Thus, out of bound array access may occur. Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from TYPE_PXB_DEV") Signed-off-by: Dmitry Frolov <frolov@swemel.ru> --- v2: assert added --- hw/cxl/cxl-host.c | 1 + include/hw/cxl/cxl.h | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)