Validate psci_find_target_suspend_lvl() result

This patch adds a runtime check that psci_find_target_suspend_lvl()
returns a valid value back to psci_cpu_suspend() and psci_get_stat().
If it is invalid, BL31 will now panic.

Note that on the PSCI CPU suspend path there is already a debug
assertion checking the validity of the target composite power state,
which effectively also checks the validity of the target suspend level.
Therefore, the error condition would already be caught in debug builds,
but in a release build this assertion would be compiled out.

On the PSCI stat path, there is currently no debug assertion checking
the validity of the power state before using it as an index into
the power domain state array.

Although BL31 platforms ports are responsible for validating the
power state parameter, the security impact (i.e. an out-of-bounds
array access) of a potential platform port bug in this code would
be quite high, given that this parameter comes from an untrusted
source. The cost of checking this in runtime generic code is low.

Change-Id: Icea85b8020e39928ac03ec0cd49805b5857b3906

diff --git a/lib/psci/psci_main.c b/lib/psci/psci_main.c
index d412be3c8d86b97a687c259e1896e6e72b41968d..3ad3dd40ef12132ff7493fc097a970e3e5d814f6 100644 (file)
--- a/lib/psci/psci_main.c
+++ b/lib/psci/psci_main.c
@@ -97,6 +97,10 @@ int psci_cpu_suspend(unsigned int power_state,
                        == PSCI_E_SUCCESS);
 
        target_pwrlvl = psci_find_target_suspend_lvl(&state_info);
+       if (target_pwrlvl == PSCI_INVALID_PWR_LVL) {
+               ERROR("Invalid target power level for suspend operation\n");
+               panic();
+       }
 
        /* Fast path for CPU standby.*/
        if (is_cpu_standby_req(is_power_down_state, target_pwrlvl)) {

diff --git a/lib/psci/psci_stat.c b/lib/psci/psci_stat.c
index 155bbb07de3f6be2de896e6c47802536eec7f123..ecbe592b8c5b0d833cf5cdeb9b18c0ab54c1599f 100644 (file)
--- a/lib/psci/psci_stat.c
+++ b/lib/psci/psci_stat.c
@@ -259,8 +259,10 @@ int psci_get_stat(u_register_t target_cpu, unsigned int power_state,
 
        /* Find the highest power level */
        pwrlvl = psci_find_target_suspend_lvl(&state_info);
-       if (pwrlvl == PSCI_INVALID_PWR_LVL)
-               return PSCI_E_INVALID_PARAMS;
+       if (pwrlvl == PSCI_INVALID_PWR_LVL) {
+               ERROR("Invalid target power level for PSCI statistics operation\n");
+               panic();
+       }
 
        /* Get the index into the stats array */
        local_state = state_info.pwr_domain_state[pwrlvl];