Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-02 09:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

cros_ec: sandbox: Use correct value for number of slots

Browse Source 
In the definition of struct ec_state the number of slots that are
created is VSTORE_SLOT_COUNT (==4) but the value of req->slot is
checked against EC_VSTORE_SLOT_MAX (==32) so this can lead to memory
access beyond that allocated.
Instead change the size check to use VSTORE_SLOT_COUNT to ensure it
matches what has actually been allocated.

This issue found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
This commit is contained in:
Andrew Goodbody
2025-07-03 11:00:33 +01:00
committed by Tom Rini
parent ebfbc77109
commit bae3a34cb9
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/misc/cros_ec_sandbox.c
View File

@@ -540,7 +540,7 @@ static int process_cmd(struct ec_state *ec,
const struct ec_params_vstore_write *req = req_data;
struct vstore_slot *slot;
if (req->slot >= EC_VSTORE_SLOT_MAX)
if (req->slot >= VSTORE_SLOT_COUNT)
return -EINVAL;
slot = &ec->slot[req->slot];
slot->locked = true;
@@ -553,7 +553,7 @@ static int process_cmd(struct ec_state *ec,
struct ec_response_vstore_read *resp = resp_data;
struct vstore_slot *slot;
if (req->slot >= EC_VSTORE_SLOT_MAX)
if (req->slot >= VSTORE_SLOT_COUNT)
return -EINVAL;
slot = &ec->slot[req->slot];
memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE);