[PATCH v3 4/4] lib: sbi_mpxy: fix integer overflow in attribute range endpoint

[Anup Patel]

On Mon, Oct 26, 2026 at 11:40 AM liutong <liutong at iscas.ac.cn> wrote:
>
> Hi Anup,
>
> Thanks for applying these. Before this one goes out, please hold it -
> as sent it does not actually fix the overflow.
>
> Widening end_id is not enough. base_attr_id and attr_count are both
> u32, so
>
>         end_id = base_attr_id + attr_count - 1;
>
> is evaluated in 32-bit arithmetic and wraps there; the already-wrapped
> result is then widened on assignment. With base_attr_id = 0xffffffff
> and attr_count = 2 the expression still yields 0, and the msgproto
> range check still passes.
>
>         u64 end_id = base + cnt - 1       -> 0x0
>         u64 end_id = (u64)base + cnt - 1  -> 0x100000000
>
> The fix is a cast at both sites, lines 500 and 653:
>
>         -       end_id = base_attr_id + attr_count - 1;
>         +       end_id = (u64)base_attr_id + attr_count - 1;
>
> I checked that the wider value cannot escape into an index or a loop
> bound. In write_attrs() the two loops over attr_id are only reached
> after end_id >= SBI_MPXY_ATTR_STD_ATTR_MAX_IDX has been rejected, and
> the msgproto branch passes base_attr_id and attr_count to the driver
> rather than end_id. read_attrs() has no loop over it.
>

I have squased the u64 type-cast for end_id assignment before
pushing to the upstream repo so nothing to be done for your side.

Regards,
Anup