Skip to content

Commit

Permalink
fel: sid: fix stack overflow while reading from SID
Browse files Browse the repository at this point in the history
When reading from the SID device using the normal memory access method,
we upload our "readl" routine (via fel_readl_n()), which expects a number
of *words* to read. However length is given in *bytes*, so we read four
times as much, and overflow our key buffer, clobbering the return address.
This is typically fatal:
===============
$ ./sunxi-fel sid
02c05200:12345678:34567890:76543210
Segmentation fault (core dumped)
$
===============

Fix this by giving the number of (32-bit) words instead. We already
checked that length is a multiple of 4, so we can just divide.

Signed-off-by: Andre Przywara <[email protected]>
  • Loading branch information
apritzel committed Nov 3, 2023
1 parent 91f9ccf commit c045b00
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion fel_lib.c
Original file line number Diff line number Diff line change
Expand Up @@ -623,7 +623,7 @@ int fel_read_sid(feldev_handle *dev, uint32_t *result,
else
/* Read SID directly from memory */
fel_readl_n(dev, soc->sid_base + soc->sid_offset + offset,
result, length);
result, length / 4);
return 0;
}

Expand Down

0 comments on commit c045b00

Please sign in to comment.