Re: [PATCH v2] hw/cxl: Fix out of bound array access

[Jonathan Cameron]

On Wed, 13 Sep 2023 16:22:28 +0300
Dmitry Frolov <frolov@swemel.ru> wrote:

> According to cxl_interleave_ways_enc(),
> fw->num_targets is allowed to be up to 16.
> This also corresponds to CXL specs.
> So, the fw->target_hbs[] array is iterated from 0 to 15.
> But it is staticaly declared of length 8.
> Thus, out of bound array access may occur.
> 
> Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from 
> TYPE_PXB_DEV")
> 
> Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
> ---
> v2: assert added
> ---
>  hw/cxl/cxl-host.c    | 1 +
>  include/hw/cxl/cxl.h | 2 +-
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
> index 034c7805b3..fe9143409b 100644
> --- a/hw/cxl/cxl-host.c
> +++ b/hw/cxl/cxl-host.c
> @@ -33,6 +33,7 @@ static void cxl_fixed_memory_window_config(CXLState 
> *cxl_state,
>      for (target = object->targets; target; target = target->next) {
>          fw->num_targets++;
>      }
> +    assert(fw->num_targets <= ARRAY_SIZE(fw->target_hbs));

Just incase it gets lost as I replied late to the v1 comment.

This is both unnecessary and results in an
assert for a case that would otherwise be a nice error message about unsupported
number of interleave ways.

Jonathan

>  
>      fw->enc_int_ways = cxl_interleave_ways_enc(fw->num_targets, errp);
>      if (*errp) {
> diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h
> index 56c9e7676e..4944725849 100644
> --- a/include/hw/cxl/cxl.h
> +++ b/include/hw/cxl/cxl.h
> @@ -29,7 +29,7 @@ typedef struct PXBCXLDev PXBCXLDev;
>  typedef struct CXLFixedWindow {
>      uint64_t size;
>      char **targets;
> -    PXBCXLDev *target_hbs[8];
> +    PXBCXLDev *target_hbs[16];
>      uint8_t num_targets;
>      uint8_t enc_int_ways;
>      uint8_t enc_int_gran;