On Fri, Nov 01, 2024 at 01:39:15PM +0000, Jonathan Cameron wrote:
> In cmd_features_set_feature() the an offset + data size schemed
Not 100% sure if I get it right, but s/the an/the/.
> is used to allow for large features. Ensure this does not write
> beyond the end fo the buffers used to accumulate the full feature
s/fo/of/
> attribute set.
Other than that,
Reviewed-by: Fan Ni <fan...@samsung.com>
>
> Reported-by: Esifiel <esif...@gmail.com>
> Signed-off-by: Jonathan Cameron <jonathan.came...@huawei.com>
> ---
> hw/cxl/cxl-mailbox-utils.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
> index a40d81219c..078782e8b9 100644
> --- a/hw/cxl/cxl-mailbox-utils.c
> +++ b/hw/cxl/cxl-mailbox-utils.c
> @@ -1292,6 +1292,11 @@ static CXLRetCode cmd_features_set_feature(const
> struct cxl_cmd *cmd,
>
> ps_set_feature = (void *)payload_in;
> ps_write_attrs = &ps_set_feature->feat_data;
> +
> + if ((uint32_t)hdr->offset + bytes_to_copy >
> + sizeof(ct3d->patrol_scrub_wr_attrs)) {
> + return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
> + }
> memcpy((uint8_t *)&ct3d->patrol_scrub_wr_attrs + hdr->offset,
> ps_write_attrs,
> bytes_to_copy);
> @@ -1314,6 +1319,11 @@ static CXLRetCode cmd_features_set_feature(const
> struct cxl_cmd *cmd,
>
> ecs_set_feature = (void *)payload_in;
> ecs_write_attrs = ecs_set_feature->feat_data;
> +
> + if ((uint32_t)hdr->offset + bytes_to_copy >
> + sizeof(ct3d->ecs_wr_attrs)) {
> + return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
> + }
> memcpy((uint8_t *)&ct3d->ecs_wr_attrs + hdr->offset,
> ecs_write_attrs,
> bytes_to_copy);
> --
> 2.43.0
>
--
Fan Ni
