]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()
authorValentina Fernandez <valentina.fernandezalanis@microchip.com>
Thu, 13 Nov 2025 13:49:22 +0000 (13:49 +0000)
committerSasha Levin <sashal@kernel.org>
Wed, 4 Mar 2026 12:20:36 +0000 (07:20 -0500)
commit0442b6229e2eedc95a6d3d18ce75dec7f5b5377c
tree8987e2d83c8d1dce9fc2c4fc3c14b5ea80f3bbbb
parentb9b6d429b6ec0687a4beac9e14bf1ae4a6202d85
mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()

[ Upstream commit f7c330a8c83c9b0332fd524097eaf3e69148164d ]

The cluster_cfg array is dynamically allocated to hold per-CPU
configuration structures, with its size based on the number of online
CPUs. Previously, this array was indexed using hartid, which may be
non-contiguous or exceed the bounds of the array, leading to
out-of-bounds access.
Switch to using cpuid as the index, as it is guaranteed to be within
the valid range provided by for_each_online_cpu().

Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/mailbox/mailbox-mchp-ipc-sbi.c