| Message ID | 20241125191009.28535-1-advaitdhamorikar@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [PATCH-next] mailbox: th1520: Fix out of bounds write | expand |
| Context | Check | Description |
|---|---|---|
| conchuod/vmtest-fixes-PR | fail | merge-conflict |
diff --git a/drivers/mailbox/mailbox-th1520.c b/drivers/mailbox/mailbox-th1520.c index 4e84640ac3b8..759634a4fb72 100644 --- a/drivers/mailbox/mailbox-th1520.c +++ b/drivers/mailbox/mailbox-th1520.c @@ -532,6 +532,9 @@ static int __maybe_unused th1520_mbox_suspend_noirq(struct device *dev) * INFO data all assumed to be lost. */ for (i = 0; i < TH_1520_MBOX_CHANS; i++) { + if (i >= ARRAY_SIZE(ctx->intr_mask)) + break; + ctx->intr_mask[i] = ioread32(priv->local_icu[i] + TH_1520_MBOX_MASK); }
The loop in the function iterates up to `TH_1520_MBOX_CHANS`, but the `ctx->intr_mask` array only has 3 elements. When `TH_1520_MBOX_CHANS` is set to a value larger than 3, this causes an out-of-bounds write at `ctx->intr_mask[3]`. This could cause an immediate crash or incorrect computations. Signed-off-by: Advait Dhamorikar <advaitdhamorikar@gmail.com> --- drivers/mailbox/mailbox-th1520.c | 3 +++ 1 file changed, 3 insertions(+)