From 8c353e0058e95cfa20c9a760ebd0908a9a9aa1c1 Mon Sep 17 00:00:00 2001
From: Thomas Viehweger <Thomas.Viehweger@rohde-schwarz.com>
Date: Mon, 23 Jan 2023 11:26:37 +0100
Subject: [PATCH] fix(tsp): loop / crash if mmap of region fails
In test_memory_send the variable i is of unsigned type, so
it is never negative. If i is 0, the result of i-- is
4294967295. Don't know what happens if trying to
access composite->address_range_array[4294967295].
Made i a signed integer.
Signed-off-by: Thomas Viehweger <Thomas.Viehweger@rohde-schwarz.com>
Change-Id: I8b4e532749b5e86e4b5acd238e72c3f88e309ff2
---
bl32/tsp/tsp_ffa_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/bl32/tsp/tsp_ffa_main.c b/bl32/tsp/tsp_ffa_main.c
index 2c53977c8..268d32974 100644
--- a/bl32/tsp/tsp_ffa_main.c
+++ b/bl32/tsp/tsp_ffa_main.c
@@ -201,7 +201,7 @@ static int test_memory_send(ffa_endpoint_id16_t sender, uint64_t handle,
/* Only expecting to be sent memory from NWd so map accordingly. */
mem_attrs |= MT_NS;
- for (uint32_t i = 0U; i < composite->address_range_count; i++) {
+ for (int32_t i = 0; i < (int32_t)composite->address_range_count; i++) {
size_t size = composite->address_range_array[i].page_count * PAGE_SIZE;
ptr = (char *) composite->address_range_array[i].address;
@@ -211,7 +211,7 @@ static int test_memory_send(ffa_endpoint_id16_t sender, uint64_t handle,
size, mem_attrs);
if (ret != 0) {
- ERROR("Failed [%u] mmap_add_dynamic_region %u (%lx) (%lx) (%x)!\n",
+ ERROR("Failed [%d] mmap_add_dynamic_region %u (%lx) (%lx) (%x)!\n",
i, ret,
(uint64_t)composite->address_range_array[i].address,
size, mem_attrs);