Skip to content

[PW_SID:1150325] mailbox: riscv-sbi-mpxy: Validate notification data length - #2516

Closed
linux-riscv-bot wants to merge 1 commit into
workflow__riscv__fixesfrom
pw1150325
Closed

[PW_SID:1150325] mailbox: riscv-sbi-mpxy: Validate notification data length#2516
linux-riscv-bot wants to merge 1 commit into
workflow__riscv__fixesfrom
pw1150325

Conversation

@linux-riscv-bot

@linux-riscv-bot linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown

PR for series 1150325 applied to workflow__riscv__fixes

Name: mailbox: riscv-sbi-mpxy: Validate notification data length
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1150325
Version: 1

@I3eg1nner Linux RISC-V bot
mailbox: riscv-sbi-mpxy: Validate notification data length
e34cb5c 
mpxy_get_notifications() copies data from shared memory using a
length derived from the SBI return value:

  memcpy(notif_data, mpxy->shmem, sret.value + 16);

sret.value is not validated against the shared memory buffer size.
A buggy firmware returning a value larger than mpxy_shmem_size - 16
would cause memcpy to read beyond the shared memory mapping.

Add a bounds check before the memcpy.

Fixes: bf3022a ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver")
Signed-off-by: liutong <liutong@iscas.ac.cn>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 146.13 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1227.21 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1468.73 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 33.21 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 30.09 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.75 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 89.53 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
kdoc
Desc: Detects for kdoc errors
Duration: 0.81 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
module-param
Desc: Detect module_param changes
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.29 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Aug 23, 2026

Copy link
Copy Markdown
Author

Patch 1: "mailbox: riscv-sbi-mpxy: Validate notification data length"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.30 seconds
Result: PASS

@linux-riscv-bot
linux-riscv-bot deleted the pw1150325 branch August 31, 2026 01:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@linux-riscv-bot @I3eg1nner