[PATCH v3 1/4] lib: sbi: dbtr: fix integer overflow in read_trig bounds check

[Anup Patel]

On Thu, Sep 10, 2026 at 10:56 AM liutong <liutong at iscas.ac.cn> wrote:
>
> In sbi_dbtr_read_trig(), the range check is:
>
>   if (trig_idx_base + trig_count >= hs->total_trigs)
>
> When trig_idx_base and trig_count are both unsigned long values supplied
> by S-mode, their sum can wrap past ULONG_MAX to a small value, making
> the check pass. For example trig_idx_base=1, trig_count=ULONG_MAX wraps
> to 0, which is less than total_trigs.
>
> This allows the subsequent for_each_trig_entry loop to access trigger
> entries far beyond the triggers[] array, corrupting M-mode heap memory
> via CSR read-back writes and leaking M-mode internal state to S-mode
> shared memory.
>
> Rewrite the condition as trig_count >= total_trigs - trig_idx_base. The
> subtraction is safe because the preceding check already guarantees
> trig_idx_base < total_trigs.
>
> Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support")
> Signed-off-by: liutong <liutong at iscas.ac.cn>
> Reviewed-by: Himanshu Chauhan <himanshu.chauhan at oss.qualcomm.com>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Applied this patch to the riscv/opensbi repo.

Thanks,
Anup

> ---
> Previously sent as [PATCH v2 1/6].
>
> Changes in v3:
> - Rebased onto current master; only the surrounding context moved, the
>   changed line is byte-identical to v2
> - Subject prefix changed to "lib: sbi: dbtr:"
> - Split into this series
>
>  lib/sbi/sbi_dbtr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/sbi/sbi_dbtr.c b/lib/sbi/sbi_dbtr.c
> index 7e4ddd98..5f66b641 100644
> --- a/lib/sbi/sbi_dbtr.c
> +++ b/lib/sbi/sbi_dbtr.c
> @@ -649,7 +649,7 @@ int sbi_dbtr_read_trig(unsigned long smode,
>                 return SBI_ERR_FAILED;
>
>         if (trig_idx_base >= hs->total_trigs ||
> -           trig_idx_base + trig_count >= hs->total_trigs)
> +           trig_count >= hs->total_trigs - trig_idx_base)
>                 return SBI_ERR_BAD_RANGE;
>
>         if (sbi_dbtr_shmem_disabled(hs))
> --
> 2.34.1
>
>
> --
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi