[PATCH v3 4/4] lib: sbi_mpxy: fix integer overflow in attribute range endpoint

[liutong]

sbi_mpxy_read_attrs() and sbi_mpxy_write_attrs() compute the end of the
requested range as a u32:

  end_id = base_attr_id + attr_count - 1;

Message protocol attribute ids extend to
SBI_MPXY_ATTR_MSGPROTO_ATTR_END (0xffffffff), so the guard
"end_id > SBI_MPXY_ATTR_MSGPROTO_ATTR_END" cannot hold for a u32 and
never rejects anything.

Such a request then reaches the message protocol driver, which computes
the same endpoint in a u32 and so passes its own range check as well,
and indexes its attribute array with attr_id2index(base_attr_id). For
base_attr_id 0xffffffff that is index 0x7fffffff, an out-of-bounds read
whose result is copied into the shared memory.

Widen end_id to u64 so the endpoint is exact and such a request is
rejected before a driver runs. The standard attribute path is not
affected, since attr_count is already limited to the shared memory size
there.

Fixes: 7939bf1329eb ("lib: sbi: Add SBI Message Proxy (MPXY) framework")
Signed-off-by: liutong <liutong at iscas.ac.cn>
---
Previously sent as [PATCH v2 6/6].

Changes in v3:
- Rebased onto current master; the code is unchanged from v2
- Commit message rewritten. v2 said the wrap made the standard
  attribute guard pass incorrectly, but attr_count is already limited
  to the shared memory size on that path, so it cannot wrap there. The
  guard that a u32 endpoint disables is the message protocol one, and
  the effect is an out-of-bounds read in the message protocol driver
  rather than on the shared memory itself.
- Split into this series

 lib/sbi/sbi_mpxy.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/sbi/sbi_mpxy.c b/lib/sbi/sbi_mpxy.c
index 2b9ad351..622c7d89 100644
--- a/lib/sbi/sbi_mpxy.c
+++ b/lib/sbi/sbi_mpxy.c
@@ -475,7 +475,8 @@ int sbi_mpxy_read_attrs(u32 channel_id, u32 base_attr_id, u32 attr_count)
 {
 	struct mpxy_state *ms = sbi_domain_mpxy_state_thishart_ptr();
 	int ret = SBI_SUCCESS;
-	u32 *attr_ptr, end_id;
+	u32 *attr_ptr;
+	u64 end_id;
 	void *shmem_base;
 	struct sbi_domain *dom = sbi_domain_thishart_ptr();
 
@@ -625,7 +626,8 @@ static void mpxy_write_std_attr(struct sbi_mpxy_channel *channel, u32 attr_id,
 int sbi_mpxy_write_attrs(u32 channel_id, u32 base_attr_id, u32 attr_count)
 {
 	struct mpxy_state *ms = sbi_domain_mpxy_state_thishart_ptr();
-	u32 *mem_ptr, attr_id, end_id, attr_val;
+	u32 *mem_ptr, attr_id, attr_val;
+	u64 end_id;
 	struct sbi_mpxy_channel *channel;
 	int ret, mem_idx;
 	void *shmem_base;
-- 
2.34.1