diff options
| author | Rizwan Qureshi <rizwan.qureshi@intel.com> | 2016-11-08 21:01:09 +0530 |
|---|---|---|
| committer | Martin Roth <martinroth@google.com> | 2016-11-09 23:29:43 +0100 |
| commit | d8bb69a451276baf14f17fceeb89790638310990 (patch) | |
| tree | 7d6a01bc3d36fbcd16b86cbed9d332c0b6b56933 | |
| parent | 1ec0c001793365d8b43f640b2bbc0080b4619d19 (diff) | |
| download | coreboot-d8bb69a451276baf14f17fceeb89790638310990.tar.xz | |
soc/intel/skylake: fix memory access beyond array bounds
chip.h has a config array PcieRpClkReqNumber which corresponds
to a FSP UPD parameter, the size is currently set to 20.
However the size of PcieRpClkReqNumber UPD in FSP2.0 is 24,
so memcpy (config buffer to UPD buffer) in chip_fsp20.c will read
beyond the bounds of config array.
Hence set the size of PcieRpClkReqNumber array based on the FSP in use.
Found-by: Coverity Scan #1365385, #1365386
Change-Id: I937f68ef33f218cd7f9ba5cf3baaec162bca3fc8
Signed-off-by: Rizwan Qureshi <rizwan.qureshi@intel.com>
Reviewed-on: https://review.coreboot.org/17292
Tested-by: build bot (Jenkins)
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
| -rw-r--r-- | src/soc/intel/skylake/Kconfig | 5 | ||||
| -rw-r--r-- | src/soc/intel/skylake/chip.h | 6 |
2 files changed, 8 insertions, 3 deletions
diff --git a/src/soc/intel/skylake/Kconfig b/src/soc/intel/skylake/Kconfig index 7591d66f50..1960a9a285 100644 --- a/src/soc/intel/skylake/Kconfig +++ b/src/soc/intel/skylake/Kconfig @@ -239,4 +239,9 @@ config SPI_FLASH_INCLUDE_ALL_DRIVERS bool default n +config MAX_ROOT_PORTS + int + default 24 if PLATFORM_USES_FSP2_0 + default 20 if PLATFORM_USES_FSP1_1 + endif diff --git a/src/soc/intel/skylake/chip.h b/src/soc/intel/skylake/chip.h index 5a4e85bf00..207c360476 100644 --- a/src/soc/intel/skylake/chip.h +++ b/src/soc/intel/skylake/chip.h @@ -161,9 +161,9 @@ struct soc_intel_skylake_config { u8 EnableTraceHub; /* Pcie Root Ports */ - u8 PcieRpEnable[20]; - u8 PcieRpClkReqSupport[20]; - u8 PcieRpClkReqNumber[20]; + u8 PcieRpEnable[CONFIG_MAX_ROOT_PORTS]; + u8 PcieRpClkReqSupport[CONFIG_MAX_ROOT_PORTS]; + u8 PcieRpClkReqNumber[CONFIG_MAX_ROOT_PORTS]; /* USB related */ struct usb2_port_config usb2_ports[16]; |