Potential overflow of notifyid on 64-bit architectures

handle_vdev_rsc sets end to RSC_NOTIFY_ID_ANY in case of wildcard notifyid Signed-off-by: Tammy Leino <tammy_leino@mentor.com>
OpenAMP · Oct 14, 2022 · 88f38c9 · 88f38c9
1 parent 03c80a1
commit 88f38c9
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 4 deletions.
diff --git a/lib/include/openamp/remoteproc.h b/lib/include/openamp/remoteproc.h
@@ -20,7 +20,7 @@
 extern "C" {
 #endif
 
-#define RSC_NOTIFY_ID_ANY 0xFFFFFFFFUL
+#define RSC_NOTIFY_ID_ANY 0xFFFFFFFFU
 
 #define RPROC_MAX_NAME_LEN 32
 

diff --git a/lib/remoteproc/remoteproc.c b/lib/remoteproc/remoteproc.c
@@ -875,7 +875,7 @@ unsigned int remoteproc_allocate_id(struct remoteproc *rproc,
 
 	if (start == RSC_NOTIFY_ID_ANY)
 		start = 0;
-	if (end == 0)
+	if (end == RSC_NOTIFY_ID_ANY)
 		end = METAL_BITS_PER_ULONG;
 	if ((start < (8U * sizeof(rproc->bitmap))) &&
 	    (end <= (8U * sizeof(rproc->bitmap)))) {

diff --git a/lib/remoteproc/rsc_table_parser.c b/lib/remoteproc/rsc_table_parser.c
@@ -134,7 +134,9 @@ int handle_vdev_rsc(struct remoteproc *rproc, void *rsc)
 	/* only assign notification IDs but do not initialize vdev */
 	notifyid = vdev_rsc->notifyid;
 	notifyid = remoteproc_allocate_id(rproc,
-					  notifyid, notifyid + 1);
+					  notifyid,
+					  notifyid == RSC_NOTIFY_ID_ANY ?
+					  RSC_NOTIFY_ID_ANY : notifyid + 1);
 	if (notifyid != RSC_NOTIFY_ID_ANY)
 		vdev_rsc->notifyid = notifyid;
 	else
@@ -148,7 +150,8 @@ int handle_vdev_rsc(struct remoteproc *rproc, void *rsc)
 		notifyid = vring_rsc->notifyid;
 		notifyid = remoteproc_allocate_id(rproc,
 						  notifyid,
-						  notifyid + 1);
+						  notifyid == RSC_NOTIFY_ID_ANY ?
+						  RSC_NOTIFY_ID_ANY : notifyid + 1);
 		if (notifyid != RSC_NOTIFY_ID_ANY)
 			vring_rsc->notifyid = notifyid;
 		else