(mynewt-core) branch master updated: hw/drivers/ipc_cmac: Validate mailbox offsets

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git


The following commit(s) were added to refs/heads/master by this push:
     new 73c201517 hw/drivers/ipc_cmac: Validate mailbox offsets
73c201517 is described below

commit 73c201517aae919ce521f73177d8a91099f6a539
Author: Szymon Janc <sz...@codecoup.pl>
AuthorDate: Sun Oct 25 23:52:38 2026 +0100

    hw/drivers/ipc_cmac: Validate mailbox offsets
    
    Mailbox read and write offsets are stored in memory shared with CMAC
    and were used without checking them against mailbox size. Mailbox
    sizes used by host were also read from CMAC writable memory on every
    access.
    
    Copy mailbox sizes during initialization, before CMAC is started, and
    fail mailbox access if offsets are outside of mailbox.
    
    Assisted-by: Claude:claude-opus-5-5
---
 hw/drivers/ipc_cmac/include/ipc_cmac/shm_hs.h |  3 +++
 hw/drivers/ipc_cmac/src/mbox.c                | 14 ++++++++++++--
 hw/drivers/ipc_cmac/src/shm_hs.c              |  8 ++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/hw/drivers/ipc_cmac/include/ipc_cmac/shm_hs.h b/hw/drivers/ipc_cmac/include/ipc_cmac/shm_hs.h
index 1de158a94..de7795430 100644
--- a/hw/drivers/ipc_cmac/include/ipc_cmac/shm_hs.h
+++ b/hw/drivers/ipc_cmac/include/ipc_cmac/shm_hs.h
@@ -30,6 +30,9 @@ extern volatile struct cmac_shm_config *g_cmac_shm_config;
 extern volatile struct cmac_shm_ctrl *g_cmac_shm_ctrl;
 extern volatile struct cmac_shm_mbox *g_cmac_shm_mbox_s2c;
 extern volatile struct cmac_shm_mbox *g_cmac_shm_mbox_c2s;
+/* Mailbox sizes, copied from shared memory before CMAC is started */
+extern uint16_t g_cmac_shm_mbox_s2c_size;
+extern uint16_t g_cmac_shm_mbox_c2s_size;
 extern volatile struct cmac_shm_dcdc *g_cmac_shm_dcdc;
 extern volatile struct cmac_shm_trim *g_cmac_shm_trim;
 extern volatile struct cmac_shm_rand *g_cmac_shm_rand;
diff --git a/hw/drivers/ipc_cmac/src/mbox.c b/hw/drivers/ipc_cmac/src/mbox.c
index d38b68d32..0eda6697a 100644
--- a/hw/drivers/ipc_cmac/src/mbox.c
+++ b/hw/drivers/ipc_cmac/src/mbox.c
@@ -35,7 +35,7 @@ mbox_src_get(uint16_t *size)
     *size = MYNEWT_VAL(CMAC_MBOX_SIZE_S2C);
 #else
     struct cmac_shm_mbox *mbox = (struct cmac_shm_mbox *)g_cmac_shm_mbox_c2s;
-    *size = g_cmac_shm_config->mbox_c2s_size;
+    *size = g_cmac_shm_mbox_c2s_size;
 #endif
 
     return mbox;
@@ -49,7 +49,7 @@ mbox_dst_get(uint16_t *size)
     *size = MYNEWT_VAL(CMAC_MBOX_SIZE_C2S);
 #else
     struct cmac_shm_mbox *mbox = (struct cmac_shm_mbox *)g_cmac_shm_mbox_s2c;
-    *size = g_cmac_shm_config->mbox_s2c_size;
+    *size = g_cmac_shm_mbox_s2c_size;
 #endif
 
     return mbox;
@@ -96,6 +96,11 @@ cmac_mbox_read(void)
         rd_off = mbox->rd_off;
         wr_off = mbox->wr_off;
 
+        /* Offsets are in shared memory, make sure they are within mailbox */
+        if (rd_off >= mbox_size || wr_off >= mbox_size) {
+            return -1;
+        }
+
         if (rd_off <= wr_off) {
             chunk = wr_off - rd_off;
         } else {
@@ -137,6 +142,11 @@ cmac_mbox_write(const void *data, uint16_t len)
         rd_off = mbox->rd_off;
         wr_off = mbox->wr_off;
 
+        /* Offsets are in shared memory, make sure they are within mailbox */
+        if (rd_off >= mbox_size || wr_off >= mbox_size) {
+            return -1;
+        }
+
         /*
          * Calculate maximum length to write, i.e. up to end of buffer or stop
          * before rd_off to be able to detect full queue.
diff --git a/hw/drivers/ipc_cmac/src/shm_hs.c b/hw/drivers/ipc_cmac/src/shm_hs.c
index 444de258a..707407dc9 100644
--- a/hw/drivers/ipc_cmac/src/shm_hs.c
+++ b/hw/drivers/ipc_cmac/src/shm_hs.c
@@ -80,6 +80,8 @@ volatile struct cmac_shm_config *g_cmac_shm_config;
 volatile struct cmac_shm_ctrl *g_cmac_shm_ctrl;
 volatile struct cmac_shm_mbox *g_cmac_shm_mbox_s2c;
 volatile struct cmac_shm_mbox *g_cmac_shm_mbox_c2s;
+uint16_t g_cmac_shm_mbox_s2c_size;
+uint16_t g_cmac_shm_mbox_c2s_size;
 volatile struct cmac_shm_trim *g_cmac_shm_trim;
 volatile struct cmac_shm_rand *g_cmac_shm_rand;
 volatile struct cmac_shm_dcdc *g_cmac_shm_dcdc;
@@ -221,6 +223,12 @@ shm_init(void)
     g_cmac_shm_ctrl = CMAC_SHARED_PTR(ih->shm_ctrl);
     g_cmac_shm_mbox_s2c = CMAC_SHARED_PTR(ih->shm_mbox_s2c);
     g_cmac_shm_mbox_c2s = CMAC_SHARED_PTR(ih->shm_mbox_c2s);
+    /*
+     * Config is writable by CMAC, so copy mailbox sizes while it is not
+     * running yet.
+     */
+    g_cmac_shm_mbox_s2c_size = g_cmac_shm_config->mbox_s2c_size;
+    g_cmac_shm_mbox_c2s_size = g_cmac_shm_config->mbox_c2s_size;
     g_cmac_shm_trim = CMAC_SHARED_PTR(ih->shm_trim);
     g_cmac_shm_rand = CMAC_SHARED_PTR(ih->shm_rand);
     g_cmac_shm_dcdc = CMAC_SHARED_PTR(ih->shm_dcdc);