MIPS OOB Write Fix: Bounds Check in maar_res_walk() cfg Array

Vulnerability Overview Vulnerability Name: MIPS: mm: Fix out-of-bounds write in Vulnerability Type: Out-of-bounds write Impact Scope: The function on the MIPS architecture, involving an out-of-bounds write issue with the array. Remediation: Add an out-of-bounds check for the array in to prevent out-of-bounds writes. POC Code ```c @@ -272,9 +272,15 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages, { struct maar_walk_info wi = data; struct maar_walk_info wi = &wi->cfg[wi->num_cfg]; struct maar_config cfg; unsigned int maar_align; / Ensure we don't overflow the cfg array / if (WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg))) return -1; / Ensure we don't overflow the cfg array */ if (WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg))) return -1; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi->num_cfg++; wi

Goal Reached Thanks to every supporter — we hit 100%!

MIPS OOB Write Fix: Bounds Check in maar_res_walk() cfg Array

More from this source