[PATCH v3 4/4] lib: sbi_mpxy: fix integer overflow in attribute range endpoint

[Anup Patel]

On Thu, Sep 10, 2026 at 10:56 AM liutong <liutong at iscas.ac.cn> wrote:
>
> sbi_mpxy_read_attrs() and sbi_mpxy_write_attrs() compute the end of the
> requested range as a u32:
>
>   end_id = base_attr_id + attr_count - 1;
>
> Message protocol attribute ids extend to
> SBI_MPXY_ATTR_MSGPROTO_ATTR_END (0xffffffff), so the guard
> "end_id > SBI_MPXY_ATTR_MSGPROTO_ATTR_END" cannot hold for a u32 and
> never rejects anything.
>
> Such a request then reaches the message protocol driver, which computes
> the same endpoint in a u32 and so passes its own range check as well,
> and indexes its attribute array with attr_id2index(base_attr_id). For
> base_attr_id 0xffffffff that is index 0x7fffffff, an out-of-bounds read
> whose result is copied into the shared memory.
>
> Widen end_id to u64 so the endpoint is exact and such a request is
> rejected before a driver runs. The standard attribute path is not
> affected, since attr_count is already limited to the shared memory size
> there.
>
> Fixes: 7939bf1329eb ("lib: sbi: Add SBI Message Proxy (MPXY) framework")
> Signed-off-by: liutong <liutong at iscas.ac.cn>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Applied this patch to the riscv/opensbi repo.

Thanks,
Anup

> ---
> Previously sent as [PATCH v2 6/6].
>
> Changes in v3:
> - Rebased onto current master; the code is unchanged from v2
> - Commit message rewritten. v2 said the wrap made the standard
>   attribute guard pass incorrectly, but attr_count is already limited
>   to the shared memory size on that path, so it cannot wrap there. The
>   guard that a u32 endpoint disables is the message protocol one, and
>   the effect is an out-of-bounds read in the message protocol driver
>   rather than on the shared memory itself.
> - Split into this series
>
>  lib/sbi/sbi_mpxy.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/lib/sbi/sbi_mpxy.c b/lib/sbi/sbi_mpxy.c
> index 2b9ad351..622c7d89 100644
> --- a/lib/sbi/sbi_mpxy.c
> +++ b/lib/sbi/sbi_mpxy.c
> @@ -475,7 +475,8 @@ int sbi_mpxy_read_attrs(u32 channel_id, u32 base_attr_id, u32 attr_count)
>  {
>         struct mpxy_state *ms = sbi_domain_mpxy_state_thishart_ptr();
>         int ret = SBI_SUCCESS;
> -       u32 *attr_ptr, end_id;
> +       u32 *attr_ptr;
> +       u64 end_id;
>         void *shmem_base;
>         struct sbi_domain *dom = sbi_domain_thishart_ptr();
>
> @@ -625,7 +626,8 @@ static void mpxy_write_std_attr(struct sbi_mpxy_channel *channel, u32 attr_id,
>  int sbi_mpxy_write_attrs(u32 channel_id, u32 base_attr_id, u32 attr_count)
>  {
>         struct mpxy_state *ms = sbi_domain_mpxy_state_thishart_ptr();
> -       u32 *mem_ptr, attr_id, end_id, attr_val;
> +       u32 *mem_ptr, attr_id, attr_val;
> +       u64 end_id;
>         struct sbi_mpxy_channel *channel;
>         int ret, mem_idx;
>         void *shmem_base;
> --
> 2.34.1
>
>
> --
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi