[PATCH] lib: utils/mailbox: Reject invalid RPMI queue indices

[Pengpeng Hou]

The RPMI shared-memory helpers validate a queue index before using it
to select queue_ctx_tbl, but the current comparison accepts queue_id
equal to queue_count.

Only entries 0 through queue_count - 1 are initialized from the device
tree. Accepting queue_count can therefore use an uninitialized queue
context when a protocol operation selects a queue omitted by the
description.

Reject queue_id greater than or equal to queue_count in both transfer
directions.

Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
---
 lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
index 521e0673..c9b2c6ef 100644
--- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
+++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
@@ -313,7 +313,7 @@ static int smq_rx(struct rpmi_shmem_mbox_controller *mctl,
 	int ret, rxretry = 0;
 	struct smq_queue_ctx *qctx;
 
-	if (mctl->queue_count < queue_id) {
+	if (queue_id >= mctl->queue_count) {
 		sbi_printf("%s: invalid queue_id or service_group_id\n",
 			   __func__);
 		return SBI_EINVAL;
@@ -348,7 +348,7 @@ static int smq_tx(struct rpmi_shmem_mbox_controller *mctl,
 	int ret, txretry = 0;
 	struct smq_queue_ctx *qctx;
 
-	if (mctl->queue_count < queue_id) {
+	if (queue_id >= mctl->queue_count) {
 		sbi_printf("%s: invalid queue_id or service_group_id\n",
 			   __func__);
 		return SBI_EINVAL;
-- 
2.50.1 (Apple Git-155)