[PATCH] lib: utils/mailbox: Reject invalid RPMI queue indices

[Anup Patel]

On Mon, Aug 31, 2026 at 6:35 PM Pengpeng Hou <pengpeng at iscas.ac.cn> wrote:
>
> The RPMI shared-memory helpers validate a queue index before using it
> to select queue_ctx_tbl, but the current comparison accepts queue_id
> equal to queue_count.
>
> Only entries 0 through queue_count - 1 are initialized from the device
> tree. Accepting queue_count can therefore use an uninitialized queue
> context when a protocol operation selects a queue omitted by the
> description.
>
> Reject queue_id greater than or equal to queue_count in both transfer
> directions.
>
> Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
> Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Applied this patch to the riscv/opensbi repo.

Thanks,
Anup

> ---
>  lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
> index 521e0673..c9b2c6ef 100644
> --- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
> +++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
> @@ -313,7 +313,7 @@ static int smq_rx(struct rpmi_shmem_mbox_controller *mctl,
>         int ret, rxretry = 0;
>         struct smq_queue_ctx *qctx;
>
> -       if (mctl->queue_count < queue_id) {
> +       if (queue_id >= mctl->queue_count) {
>                 sbi_printf("%s: invalid queue_id or service_group_id\n",
>                            __func__);
>                 return SBI_EINVAL;
> @@ -348,7 +348,7 @@ static int smq_tx(struct rpmi_shmem_mbox_controller *mctl,
>         int ret, txretry = 0;
>         struct smq_queue_ctx *qctx;
>
> -       if (mctl->queue_count < queue_id) {
> +       if (queue_id >= mctl->queue_count) {
>                 sbi_printf("%s: invalid queue_id or service_group_id\n",
>                            __func__);
>                 return SBI_EINVAL;
> --
> 2.50.1 (Apple Git-155)
>
>
> --
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi