michaelh/zephyr
1
0
Fork 0
Code Releases Activity

driver: timer: npcx: fix possible vulnerabilities

Browse source 
This commit fixes some potential leakage in the timer driver.

Signed-off-by: Jun Lin <CHLin56@nuvoton.com>
This commit is contained in:
Jun Lin 2024-12-11 17:54:18 +08:00 • committed by Benjamin Cabé
commit bdf0500497
1 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
drivers/timer/npcx_itim_timer.c
View file

@ -140,8 +140,6 @@ static inline void npcx_itim_evt_disable(void)
/* ITIM local functions */ /* ITIM local functions */
static int npcx_itim_start_evt_tmr_by_tick(int32_t ticks) static int npcx_itim_start_evt_tmr_by_tick(int32_t ticks)
{ {
k_spinlock_key_t key = k_spin_lock(&lock);
/* /*
* Get desired cycles of event timer from the requested ticks which * Get desired cycles of event timer from the requested ticks which
* round up to next tick boundary. * round up to next tick boundary.
@ -152,7 +150,7 @@ static int npcx_itim_start_evt_tmr_by_tick(int32_t ticks)
} else { } else {
uint64_t next_cycs; uint64_t next_cycs;
uint64_t curr = npcx_itim_get_sys_cyc64(); uint64_t curr = npcx_itim_get_sys_cyc64();
uint32_t dcycles; uint64_t dcycles;
if (ticks <= 0) { if (ticks <= 0) {
ticks = 1; ticks = 1;
@ -162,11 +160,13 @@ static int npcx_itim_start_evt_tmr_by_tick(int32_t ticks)
if (unlikely(next_cycs <= curr)) { if (unlikely(next_cycs <= curr)) {
cyc_evt_timeout = 1; cyc_evt_timeout = 1;
} else { } else {
dcycles = next_cycs - curr; uint32_t dticks;
cyc_evt_timeout =
CLAMP((dcycles / SYS_CYC_PER_EVT_CYC), 1, NPCX_ITIM32_MAX_CNT);
}
dcycles = next_cycs - curr;
dticks = DIV_ROUND_UP(dcycles * EVT_CYCLES_PER_SEC,
sys_clock_hw_cycles_per_sec());
cyc_evt_timeout = CLAMP(dticks, 1, NPCX_ITIM32_MAX_CNT);
}
} }
LOG_DBG("ticks %x, cyc_evt_timeout %x", ticks, cyc_evt_timeout); LOG_DBG("ticks %x, cyc_evt_timeout %x", ticks, cyc_evt_timeout);
@ -178,7 +178,6 @@ static int npcx_itim_start_evt_tmr_by_tick(int32_t ticks)
/* Upload counter of event timer */ /* Upload counter of event timer */
evt_tmr->ITCNT32 = MAX(cyc_evt_timeout - 1, 1); evt_tmr->ITCNT32 = MAX(cyc_evt_timeout - 1, 1);
k_spin_unlock(&lock, key);
/* Enable event timer and start ticking */ /* Enable event timer and start ticking */
return npcx_itim_evt_enable(); return npcx_itim_evt_enable();
} }
@ -235,13 +234,13 @@ static uint32_t npcx_itim_evt_elapsed_cyc32(void)
{ {
uint32_t cnt1 = npcx_itim_get_evt_cyc32(); uint32_t cnt1 = npcx_itim_get_evt_cyc32();
uint8_t sys_cts = evt_tmr->ITCTS32; uint8_t sys_cts = evt_tmr->ITCTS32;
uint16_t cnt2 = npcx_itim_get_evt_cyc32(); uint32_t cnt2 = npcx_itim_get_evt_cyc32();
/* Event has been triggered but timer ISR doesn't handle it */ /* Event has been triggered but timer ISR doesn't handle it */
if (IS_BIT_SET(sys_cts, NPCX_ITCTSXX_TO_STS) || (cnt2 > cnt1)) { if (IS_BIT_SET(sys_cts, NPCX_ITCTSXX_TO_STS) || (cnt2 > cnt1)) {
cnt2 = cyc_evt_timeout; cnt2 = cyc_evt_timeout;
} else { } else {
cnt2 = cyc_evt_timeout - cnt2; cnt2 = cyc_evt_timeout - cnt2 - 1;
} }
/* Return elapsed cycles of 32-bit counter of event timer */ /* Return elapsed cycles of 32-bit counter of event timer */
@ -261,7 +260,10 @@ void sys_clock_set_timeout(int32_t ticks, bool idle)
LOG_DBG("timeout is %d", ticks); LOG_DBG("timeout is %d", ticks);
/* Start a event timer in ticks */ /* Start a event timer in ticks */
k_spinlock_key_t key = k_spin_lock(&lock);
npcx_itim_start_evt_tmr_by_tick(ticks); npcx_itim_start_evt_tmr_by_tick(ticks);
k_spin_unlock(&lock, key);
} }
uint32_t sys_clock_elapsed(void) uint32_t sys_clock_elapsed(void)
@ -273,7 +275,7 @@ uint32_t sys_clock_elapsed(void)
k_spinlock_key_t key = k_spin_lock(&lock); k_spinlock_key_t key = k_spin_lock(&lock);
uint64_t delta_cycle = npcx_itim_get_sys_cyc64() - cyc_sys_announced; uint64_t delta_cycle = npcx_itim_get_sys_cyc64() - cyc_sys_announced;
uint32_t delta_ticks = (uint32_t)delta_cycle / SYS_CYCLES_PER_TICK; uint32_t delta_ticks = (uint32_t)(delta_cycle / SYS_CYCLES_PER_TICK);
last_elapsed = delta_ticks; last_elapsed = delta_ticks;
k_spin_unlock(&lock, key); k_spin_unlock(&lock, key);