Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-05-08 18:41:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Validate psci_find_target_suspend_lvl() result

Browse source 
This patch adds a runtime check that psci_find_target_suspend_lvl()
returns a valid value back to psci_cpu_suspend() and psci_get_stat().
If it is invalid, BL31 will now panic.

Note that on the PSCI CPU suspend path there is already a debug
assertion checking the validity of the target composite power state,
which effectively also checks the validity of the target suspend level.
Therefore, the error condition would already be caught in debug builds,
but in a release build this assertion would be compiled out.

On the PSCI stat path, there is currently no debug assertion checking
the validity of the power state before using it as an index into
the power domain state array.

Although BL31 platforms ports are responsible for validating the
power state parameter, the security impact (i.e. an out-of-bounds
array access) of a potential platform port bug in this code would
be quite high, given that this parameter comes from an untrusted
source. The cost of checking this in runtime generic code is low.

Change-Id: Icea85b8020e39928ac03ec0cd49805b5857b3906
This commit is contained in:
Sandrine Bailleux 2016-06-22 16:35:01 +01:00
parent 3dd9835f8a
commit a1c3faa6c7
2 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/psci/psci_stat.c
View file

@ -259,8 +259,10 @@ int psci_get_stat(u_register_t target_cpu, unsigned int power_state,
/* Find the highest power level */
pwrlvl = psci_find_target_suspend_lvl(&state_info);
if (pwrlvl == PSCI_INVALID_PWR_LVL)
return PSCI_E_INVALID_PARAMS;
if (pwrlvl == PSCI_INVALID_PWR_LVL) {
ERROR("Invalid target power level for PSCI statistics operation\n");
panic();
}
/* Get the index into the stats array */
local_state = state_info.pwr_domain_state[pwrlvl];