[PW_SID:1145928] [v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths - #2469
[PW_SID:1145928] [v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths#2469linux-riscv-bot wants to merge 2 commits into
Conversation
The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory size before that copy. The event walker also uses a reversed loop condition and can inspect a short event record. Validate the complete notification length before copying it, iterate only while a full event header remains, and stop when a declared event payload extends beyond the copied notification data. Fixes: bf3022a ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
9fa746d to
3c76238
Compare
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
|
Patch 1: "[v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths" |
bb1a926 to
6f6f7c0
Compare
PR for series 1145928 applied to workflow__riscv__fixes
Name: [v2] mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1145928
Version: 2