[PATCH] mailbox: riscv-sbi-mpxy: Validate notification data length

mpxy_get_notifications() copies data from shared memory using a
length derived from the SBI return value:

  memcpy(notif_data, mpxy->shmem, sret.value + 16);

sret.value is not validated against the shared memory buffer size.
A buggy firmware returning a value larger than mpxy_shmem_size - 16
would cause memcpy to read beyond the shared memory mapping.

Add a bounds check before the memcpy.

Fixes: bf3022a4eb11 ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver")
Signed-off-by: liutong <[email protected]>
---
 drivers/mailbox/riscv-sbi-mpxy-mbox.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mailbox/riscv-sbi-mpxy-mbox.c b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
index 18da9efcc..3a2d52bbc 100644
--- a/drivers/mailbox/riscv-sbi-mpxy-mbox.c
+++ b/drivers/mailbox/riscv-sbi-mpxy-mbox.c
@@ -315,6 +315,11 @@ static int mpxy_get_notifications(u32 channel_id,
 	if (sret.error)
 		goto err_put_cpu;
 
+	if (sret.value + 16 > mpxy_shmem_size) {
+		put_cpu();
+		return -EIO;
+	}
+
 	memcpy(notif_data, mpxy->shmem, sret.value + 16);
 	*events_data_len = sret.value;
 
-- 
2.34.1


_______________________________________________
linux-riscv mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-riscv