From 4195b10d5267d7b48fc57cb9a50d6d6f48d73439 Mon Sep 17 00:00:00 2001 From: Richard Spiegel Date: Tue, 28 Nov 2017 06:54:02 -0700 Subject: [PATCH] amd/{hudson,stoneyridge}: fix out of bounds read southbridge/amd/pi/hudson/imc.c procedure enable_imc_thermal_zone was identified by coverity as having out of bounds access. Copies of the procedure are present in southbridge/amd/agesa/hudson/imc.c and in soc/amd/stoneyridge/imc.c. Fix the procedure in all 3 files. Fixes coverity CID 1260807: Out-of-bounds read. BUG=b:69835834 TEST=Build and platform boot to OS Change-Id: Ic16edc607358b9a688151735e6fcb3393d3bce80 Signed-off-by: Richard Spiegel Reviewed-on: https://review.coreboot.org/22619 Tested-by: build bot (Jenkins) Reviewed-by: Aaron Durbin --- src/soc/amd/stoneyridge/imc.c | 6 +++--- src/southbridge/amd/agesa/hudson/imc.c | 6 +++--- src/southbridge/amd/pi/hudson/imc.c | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/soc/amd/stoneyridge/imc.c b/src/soc/amd/stoneyridge/imc.c index 4c505df522..f7eed205d0 100644 --- a/src/soc/amd/stoneyridge/imc.c +++ b/src/soc/amd/stoneyridge/imc.c @@ -50,7 +50,7 @@ void enable_imc_thermal_zone(void) { AMD_CONFIG_PARAMS StdHeader; UINT8 FunNum; - UINT8 regs[9]; + UINT8 regs[10]; int i; regs[0] = 0; @@ -61,7 +61,7 @@ void enable_imc_thermal_zone(void) WriteECmsg(MSG_SYS_TO_IMC, AccessWidth8, &FunNum, &StdHeader); WaitForEcLDN9MailboxCmdAck(&StdHeader); - for (i = 2 ; i <= 9 ; i++) + for (i = 2 ; i < ARRAY_SIZE(regs) ; i++) ReadECmsg(MSG_REG0 + i, AccessWidth8, ®s[i], &StdHeader); /* enable thermal zone 0 */ @@ -69,7 +69,7 @@ void enable_imc_thermal_zone(void) regs[0] = 0; regs[1] = 0; FunNum = Fun_81; - for (i = 0 ; i <= 9 ; i++) + for (i = 0 ; i < ARRAY_SIZE(regs) ; i++) WriteECmsg(MSG_REG0 + i, AccessWidth8, ®s[i], &StdHeader); WriteECmsg(MSG_SYS_TO_IMC, AccessWidth8, &FunNum, &StdHeader); WaitForEcLDN9MailboxCmdAck(&StdHeader); diff --git a/src/southbridge/amd/agesa/hudson/imc.c b/src/southbridge/amd/agesa/hudson/imc.c index 799cc32e40..3d758d7ab1 100644 --- a/src/southbridge/amd/agesa/hudson/imc.c +++ b/src/southbridge/amd/agesa/hudson/imc.c @@ -60,7 +60,7 @@ void enable_imc_thermal_zone(void) { AMD_CONFIG_PARAMS StdHeader; UINT8 FunNum; - UINT8 regs[9]; + UINT8 regs[10]; int i; regs[0] = 0; @@ -71,7 +71,7 @@ void enable_imc_thermal_zone(void) WriteECmsg(MSG_SYS_TO_IMC, AccessWidth8, &FunNum, &StdHeader); // function number WaitForEcLDN9MailboxCmdAck(&StdHeader); - for (i = 2; i <= 9; i++) + for (i = 2; i < ARRAY_SIZE(regs); i++) ReadECmsg(MSG_REG0 + i, AccessWidth8, ®s[i], &StdHeader); /* enable thermal zone 0 */ @@ -79,7 +79,7 @@ void enable_imc_thermal_zone(void) regs[0] = 0; regs[1] = 0; FunNum = Fun_81; - for (i = 0; i <= 9; i++) + for (i = 0; i < ARRAY_SIZE(regs); i++) WriteECmsg(MSG_REG0 + i, AccessWidth8, ®s[i], &StdHeader); WriteECmsg(MSG_SYS_TO_IMC, AccessWidth8, &FunNum, &StdHeader); // function number WaitForEcLDN9MailboxCmdAck(&StdHeader); diff --git a/src/southbridge/amd/pi/hudson/imc.c b/src/southbridge/amd/pi/hudson/imc.c index 53e97fbae3..bb630149b8 100644 --- a/src/southbridge/amd/pi/hudson/imc.c +++ b/src/southbridge/amd/pi/hudson/imc.c @@ -56,7 +56,7 @@ void enable_imc_thermal_zone(void) { AMD_CONFIG_PARAMS StdHeader; UINT8 FunNum; - UINT8 regs[9]; + UINT8 regs[10]; int i; regs[0] = 0; @@ -67,7 +67,7 @@ void enable_imc_thermal_zone(void) WriteECmsg(MSG_SYS_TO_IMC, AccessWidth8, &FunNum, &StdHeader); WaitForEcLDN9MailboxCmdAck(&StdHeader); - for (i = 2; i <= 9; i++) + for (i = 2; i < ARRAY_SIZE(regs); i++) ReadECmsg(MSG_REG0 + i, AccessWidth8, ®s[i], &StdHeader); /* enable thermal zone 0 */ @@ -75,7 +75,7 @@ void enable_imc_thermal_zone(void) regs[0] = 0; regs[1] = 0; FunNum = Fun_81; - for (i = 0; i <= 9; i++) + for (i = 0; i < ARRAY_SIZE(regs); i++) WriteECmsg(MSG_REG0 + i, AccessWidth8, ®s[i], &StdHeader); WriteECmsg(MSG_SYS_TO_IMC, AccessWidth8, &FunNum, &StdHeader); WaitForEcLDN9MailboxCmdAck(&StdHeader);