[PATCH v2 1/6] lib: sbi_dbtr: fix integer overflow in read_trig bounds check

[Himanshu Chauhan]

On Fri, Jul 31, 2026 at 10:34:00AM +0000, liutong wrote:
> In sbi_dbtr_read_trig(), the range check is:
> 
>   if (trig_idx_base + trig_count >= hs->total_trigs)
> 
> When trig_idx_base and trig_count are both unsigned long values supplied
> by S-mode, their sum can wrap past ULONG_MAX to a small value, making
> the check pass. For example trig_idx_base=1, trig_count=ULONG_MAX wraps
> to 0, which is less than total_trigs.
> 
> This allows the subsequent for_each_trig_entry loop to access trigger
> entries far beyond the triggers[] array, corrupting M-mode heap memory
> via CSR read-back writes and leaking M-mode internal state to S-mode
> shared memory.
> 
> Rewrite the condition as trig_count >= total_trigs - trig_idx_base. The
> subtraction is safe because the preceding check already guarantees
> trig_idx_base < total_trigs.
> 
> Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support")
> Signed-off-by: liutong <liutong at iscas.ac.cn>
> ---
> 
> Previously sent as [PATCH].
> Changes in v2:
> - Added Fixes tag
> - Consolidated into patch series
> 
>  lib/sbi/sbi_dbtr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/sbi/sbi_dbtr.c b/lib/sbi/sbi_dbtr.c
> index 01047969..eeab7d3a 100644
> --- a/lib/sbi/sbi_dbtr.c
> +++ b/lib/sbi/sbi_dbtr.c
> @@ -572,7 +572,7 @@ int sbi_dbtr_read_trig(unsigned long smode,
>  		return SBI_ERR_FAILED;
>  
>  	if (trig_idx_base >= hs->total_trigs ||
> -	    trig_idx_base + trig_count >= hs->total_trigs)
> +	    trig_count >= hs->total_trigs - trig_idx_base)
>  		return SBI_ERR_INVALID_PARAM;
Looks good to me.

Reviewed-by: Himanshu Chauhan <himanshu.chauhan at oss.qualcomm.com>

>  
>  	if (sbi_dbtr_shmem_disabled(hs))
> -- 
> 2.34.1
> 
> 
> -- 
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi