diff options
| author | Yann Gautier <yann.gautier@st.com> | 2026-08-28 18:51:14 +0200 |
|---|---|---|
| committer | Yann Gautier <yann.gautier@st.com> | 2026-09-07 13:37:22 +0200 |
| commit | 01255a389631d75202efdbbf6867056b866dc8df (patch) | |
| tree | e441234ca4eac6464f9922022f3128e607eee68a /drivers | |
| parent | a6d10d2c521fb0614869866f2f6782fb5c3bb5a0 (diff) | |
| download | arm-trusted-firmware-01255a389631d75202efdbbf6867056b866dc8df.tar.gz arm-trusted-firmware-01255a389631d75202efdbbf6867056b866dc8df.zip | |
fix(io): correct SIZE_MAX management
Checking if the size or offset is above SIZE_MAX in the different io
files makes sense only for aarch32 platforms where SIZE_MAX is an u32.
On aarch64 system, this cannot happen as SIZE_MAX is the max of an u64.
And it triggers a warning, for example with clang:
drivers/io/io_block.c:199:16: error: result of comparison 'unsigned long
long' > 18446744073709551615 is always false
[-Werror,-Wtautological-type-limit-compare]
199 | if (cur->size > (unsigned long long)SIZE_MAX) {
| ~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
However, the check on offset + size should be changed to an overflow
check with check_u64_overflow() for aarch64 platforms. That was already
the goal of `(offset + size < offset)` so replace it.
Change-Id: I76391ac86ddb2ab359b5401e6c776c3995c55ce3
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/io/io_block.c | 3 | ||||
| -rw-r--r-- | drivers/io/io_fip.c | 8 | ||||
| -rw-r--r-- | drivers/io/io_mtd.c | 3 |
3 files changed, 12 insertions, 2 deletions
diff --git a/drivers/io/io_block.c b/drivers/io/io_block.c index ea7512272..db8eaba9a 100644 --- a/drivers/io/io_block.c +++ b/drivers/io/io_block.c @@ -196,9 +196,12 @@ static int block_len(io_entity_t *entity, size_t *length) assert(length != NULL); cur = (block_dev_state_t *)entity->info; + +#ifndef __aarch64__ if (cur->size > (unsigned long long)SIZE_MAX) { return -EINVAL; } +#endif *length = (size_t)cur->size; return 0; diff --git a/drivers/io/io_fip.c b/drivers/io/io_fip.c index f06e98a2f..c70d435c1 100644 --- a/drivers/io/io_fip.c +++ b/drivers/io/io_fip.c @@ -405,11 +405,15 @@ static int fip_file_open(io_dev_info_t *dev_info, const uintptr_t spec, if ((size == 0U) || (offset >= fip_size64) || (size > fip_size64) || - (offset + size < offset) || (offset + size > fip_size64) || +#ifdef __aarch64__ + check_u64_overflow(offset, size) +#else (offset > (uint64_t)SIZE_MAX) || (size > (uint64_t)SIZE_MAX) || - (offset + size > (uint64_t)SIZE_MAX)) { + (offset + size > (uint64_t)SIZE_MAX) +#endif + ) { ERROR("FIP entry bounds invalid\n"); result = -EINVAL; goto fip_file_open_close; diff --git a/drivers/io/io_mtd.c b/drivers/io/io_mtd.c index abf0d3498..73418fe92 100644 --- a/drivers/io/io_mtd.c +++ b/drivers/io/io_mtd.c @@ -211,9 +211,12 @@ static int mtd_len(io_entity_t *entity, size_t *length) assert(length != NULL); cur = (mtd_dev_state_t *)entity->info; + +#ifndef __aarch64__ if (cur->size > (unsigned long long)SIZE_MAX) { return -EINVAL; } +#endif *length = (size_t)cur->size; return 0; |