[PATCH v3 0/4] lib: sbi: fix integer overflows in shared memory bounds checks

[liutong]

Patches 1, 2 and 4 share one root cause: a length or index supplied by
S-mode is combined with another value before being range checked, so the
arithmetic can wrap and the check then accepts a request that is out of
range.

  - sbi_dbtr_read_trig() adds trig_idx_base + trig_count
  - sbi_pmu_event_get_info() multiplies num_events by the entry size
  - sbi_mpxy_read_attrs()/write_attrs() add base_attr_id + attr_count
    as u32

Patch 3 is not an overflow, but it is in the function patch 2 touches:
the reserved-event_idx path added in d97cfb33 returns without unmapping
the shared memory it just mapped.

These were previously sent as part of a single six patch series. They
are split out here because the other three patches address shared
memory double-fetches in DBTR and SSE and need more discussion, while
these are small and independent. The other half is sent separately as
"[PATCH v3 0/3] lib: sbi: fix shared memory double-fetch in DBTR and
SSE". Both halves apply to master in either order.

Changes in v3:
- Rebased onto current master
- Split out of the previous six patch series
- 1/4: only the surrounding context changed, the fix itself is
  byte-identical to v2, so the Reviewed-by is carried over. Subject
  prefix changed to "lib: sbi: dbtr:" to match the rest of the file's
  history.
- 2/4: rebased; commit message reworded
- 3/4: new, and unrelated to v2
- 4/4: rebased. Commit message rewritten: v2 described the standard
  attribute range guard, but that one is not reachable with a wrapping
  endpoint. The affected guard is the message protocol one.
- Link to v2: https://lore.kernel.org/opensbi/20260731103405.1535818-1-liutong@iscas.ac.cn/

liutong (4):
  lib: sbi: dbtr: fix integer overflow in read_trig bounds check
  lib: sbi_pmu: fix integer overflow and zero-address in event_get_info
  lib: sbi_pmu: unmap shared memory on the reserved event_idx path
  lib: sbi_mpxy: fix integer overflow in attribute range endpoint

 lib/sbi/sbi_dbtr.c |  2 +-
 lib/sbi/sbi_mpxy.c |  6 ++++--
 lib/sbi/sbi_pmu.c  | 15 +++++++++++++--
 3 files changed, 18 insertions(+), 5 deletions(-)


base-commit: 3593a5facc4c6938b90429a6973ba9ee21fc5899
-- 
2.34.1