From 472452795c0718c7a2db4c06a87e57612b488552 Mon Sep 17 00:00:00 2001 From: Tammy Leino Date: Tue, 26 Jul 2022 08:29:18 -0700 Subject: [PATCH] Vring descriptor count must be limited to 65k per device Code must ensure we don't overflow the 16-bit count in vring_alloc_info Signed-off-by: Tammy Leino --- lib/include/openamp/remoteproc_virtio.h | 3 +++ lib/remoteproc/remoteproc_virtio.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/include/openamp/remoteproc_virtio.h b/lib/include/openamp/remoteproc_virtio.h index a5c609308..8905b1029 100644 --- a/lib/include/openamp/remoteproc_virtio.h +++ b/lib/include/openamp/remoteproc_virtio.h @@ -20,6 +20,9 @@ extern "C" { #endif +/* maximum number of vring descriptors for a vdev */ +#define RPROC_MAX_VRING_DESC 65535 + /* define vdev notification function user should implement */ typedef int (*rpvdev_notify_func)(void *priv, uint32_t id); diff --git a/lib/remoteproc/remoteproc_virtio.c b/lib/remoteproc/remoteproc_virtio.c index a623276ea..ee3feff1e 100644 --- a/lib/remoteproc/remoteproc_virtio.c +++ b/lib/remoteproc/remoteproc_virtio.c @@ -296,7 +296,7 @@ int rproc_virtio_init_vring(struct virtio_device *vdev, unsigned int index, unsigned int num_vrings; num_vrings = vdev->vrings_num; - if (index >= num_vrings) + if ((index >= num_vrings) || (num_descs > RPROC_MAX_VRING_DESC)) return -RPROC_EINVAL; vring_info = &vdev->vrings_info[index]; vring_info->io = io;