[PATCH v2] lib: sbi_pmu: fix integer overflow and zero-address in event_get_info

[Rahul Pathak]

On Thu, Jul 30, 2026 at 9:34 PM liutong <liutong at iscas.ac.cn> wrote:
>
> sbi_pmu_event_get_info() computes the shared memory size as
> num_events * sizeof(struct sbi_pmu_event_info) without checking for
> integer overflow. A sufficiently large num_events causes the product to
> wrap around, making the domain check pass on a truncated size while the
> loop iterates with the original count.
>
> This allows S-mode to trigger out-of-bounds writes in M-mode memory.
> A zero physical address is also not rejected, which would cause M-mode
> to write to address 0 and hang the hart.
>
> Add bounds checking on num_events before the multiplication and reject
> zero shmem addresses early.
>
> Fixes: e4345842168b ("lib: sbi_pmu: Implement SBI PMU event info function")
> Signed-off-by: liutong <liutong at iscas.ac.cn>
> ---
>
> Changes in v2:
> - Added Fixes tag
>

You need to send new version of the patch with annotating it in
subject "[PATCH v2]"

I also suggest you convert your recent patches into a series.