Skip to content

Commit

Permalink
fel: sid: fix stack overflow while reading from SID
Browse files Browse the repository at this point in the history
When reading from the SID device using the normal memory access method,
we upload our "readl" routine (via fel_readl_n()), which expects a number
of *words* to read. However length is given in *bytes*, so we read four
times as much, and overflow our key buffer, clobbering the return address.
This is typically fatal:
===============
$ ./sunxi-fel sid
02c05200:12345678:34567890:76543210
Segmentation fault (core dumped)
$
===============

Fix this by giving the number of (32-bit) words instead. We already
checked that length is a multiple of 4, so we can just divide.

Signed-off-by: Andre Przywara <osp@andrep.de>
  • Loading branch information
apritzel authored and paulkocialkowski committed Nov 3, 2023
1 parent 91f9ccf commit fcb7865
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion fel_lib.c
Original file line number Diff line number Diff line change
Expand Up @@ -623,7 +623,7 @@ int fel_read_sid(feldev_handle *dev, uint32_t *result,
else
/* Read SID directly from memory */
fel_readl_n(dev, soc->sid_base + soc->sid_offset + offset,
result, length);
result, length / 4);
return 0;
}

Expand Down

0 comments on commit fcb7865

Please sign in to comment.