[PATCH] lib: utils/mailbox: reject undersized RPMI shmem queues

[Pengpeng Hou]

The RPMI shared-memory mailbox transport derives qctx->num_slots from the
device-tree queue window size and the riscv,slot-size property. The current
initialization only checks that the queue window is nonzero before
subtracting the two RPMI header slots.

Reject queue windows that cannot provide the two header slots plus at least
two data ring slots. A zero data-slot count would later be used as a modulo
divisor, and a one-slot ring is also unusable with the current full/empty
convention because one empty slot is reserved to distinguish the two
states.

Also reject data-slot counts that cannot be represented by qctx->num_slots.

Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
---
 lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
index 521e0673..4457617a 100644
--- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
+++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
@@ -589,6 +589,7 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
 	const fdt32_t *prop;
 	int count, len, ret, qid;
 	uint64_t reg_addr, reg_size;
+	u64 total_slots;
 	struct smq_queue_ctx *qctx;
 
 	ret = fdt_node_check_compatible(fdt, nodeoff,
@@ -638,6 +639,14 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
 		if (ret < 0 || !reg_addr || !reg_size)
 			return SBI_ENOENT;
 
+		/* calculate number of slots in each queue */
+		total_slots = reg_size / mctl->slot_size;
+		if (total_slots < RPMI_QUEUE_HEADER_SLOTS + 2 ||
+		    total_slots - RPMI_QUEUE_HEADER_SLOTS > (u32)-1)
+			return SBI_EINVAL;
+
+		qctx->num_slots = total_slots - RPMI_QUEUE_HEADER_SLOTS;
+
 		ret = sbi_domain_root_add_memrange(reg_addr, reg_size, reg_size,
 						   (SBI_DOMAIN_MEMREGION_MMIO |
 						    SBI_DOMAIN_MEMREGION_M_READABLE |
@@ -645,10 +654,6 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
 		if (ret)
 			return ret;
 
-		/* calculate number of slots in each queue */
-		qctx->num_slots =
-			(reg_size - (mctl->slot_size * RPMI_QUEUE_HEADER_SLOTS)) / mctl->slot_size;
-
 		/* setup queue pointers */
 		qctx->headptr = ((void *)(unsigned long)reg_addr) +
 				RPMI_QUEUE_HEAD_SLOT * mctl->slot_size;

base-commit: 4e79fd7de59f1b2899092c1a84ce68c8ebc68f93
-- 
2.43.0