Browse Source

fix(tsp): loop / crash if mmap of region fails

In test_memory_send the variable i is of unsigned type, so
it is never negative. If i is 0, the result of i-- is
4294967295. Don't know what happens if trying to
access composite->address_range_array[4294967295].
Made i a signed integer.

Signed-off-by: Thomas Viehweger <Thomas.Viehweger@rohde-schwarz.com>
Change-Id: I8b4e532749b5e86e4b5acd238e72c3f88e309ff2
pull/1993/head
Thomas Viehweger 2 years ago
parent
commit
8c353e0058
  1. 4
      bl32/tsp/tsp_ffa_main.c

4
bl32/tsp/tsp_ffa_main.c

@ -201,7 +201,7 @@ static int test_memory_send(ffa_endpoint_id16_t sender, uint64_t handle,
/* Only expecting to be sent memory from NWd so map accordingly. */
mem_attrs |= MT_NS;
for (uint32_t i = 0U; i < composite->address_range_count; i++) {
for (int32_t i = 0; i < (int32_t)composite->address_range_count; i++) {
size_t size = composite->address_range_array[i].page_count * PAGE_SIZE;
ptr = (char *) composite->address_range_array[i].address;
@ -211,7 +211,7 @@ static int test_memory_send(ffa_endpoint_id16_t sender, uint64_t handle,
size, mem_attrs);
if (ret != 0) {
ERROR("Failed [%u] mmap_add_dynamic_region %u (%lx) (%lx) (%x)!\n",
ERROR("Failed [%d] mmap_add_dynamic_region %u (%lx) (%lx) (%x)!\n",
i, ret,
(uint64_t)composite->address_range_array[i].address,
size, mem_attrs);

Loading…
Cancel
Save