GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

soc/intel/skylake: fix memory access beyond array bounds 

chip.h has a config array PcieRpClkReqNumber which corresponds
to a FSP UPD parameter, the size is currently set to 20.
However the size of PcieRpClkReqNumber UPD in FSP2.0 is 24,
so memcpy (config buffer to UPD buffer) in chip_fsp20.c will read
beyond the bounds of config array.
Hence set the size of PcieRpClkReqNumber array based on the FSP in use.

Found-by: Coverity Scan #1365385, #1365386

Change-Id: I937f68ef33f218cd7f9ba5cf3baaec162bca3fc8
Signed-off-by: Rizwan Qureshi <rizwan.qureshi@intel.com>
Reviewed-on: https://review.coreboot.org/17292
Tested-by: build bot (Jenkins)
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
This commit is contained in:
Rizwan Qureshi 2016-11-08 21:01:09 +05:30 committed by Martin Roth
parent 1ec0c00179
commit d8bb69a451
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/soc/intel/skylake/Kconfig
View File

@ -239,4 +239,9 @@ config SPI_FLASH_INCLUDE_ALL_DRIVERS
bool
default n
config MAX_ROOT_PORTS
int
default 24 if PLATFORM_USES_FSP2_0
default 20 if PLATFORM_USES_FSP1_1
endif

6
src/soc/intel/skylake/chip.h
View File

@ -161,9 +161,9 @@ struct soc_intel_skylake_config {
u8 EnableTraceHub;
/* Pcie Root Ports */
u8 PcieRpEnable[20];
u8 PcieRpClkReqSupport[20];
u8 PcieRpClkReqNumber[20];
u8 PcieRpEnable[CONFIG_MAX_ROOT_PORTS];
u8 PcieRpClkReqSupport[CONFIG_MAX_ROOT_PORTS];
u8 PcieRpClkReqNumber[CONFIG_MAX_ROOT_PORTS];
/* USB related */
struct usb2_port_config usb2_ports[16];