Skip to content

Commit ec2aa32

Browse files
committed
Fix crash in cpuid_riscv64.c
The crash is reproducible when building OpenBLAS without forcing a target in a riscv64 container running on an X86_64 machine with an older version of QEMU, e.g., 7.0.0, registered with binfmt_misc to run riscv64 binaries. With this setup, cat /proc/cpuinfo in the container returns the cpu information for the host, which contains a "model name" string, and we execute the buggy code. The code in question is searching in an uninitialised buffer for the ':' character and doesn't check to see whether it was found or not. This can result in pmodel containing the pointer value 1 and a crash when pmodel is defererenced. The algorithm to detect the C910V CPU has not been modified, merely fixed to prevent the crash. A few additional checks for NULL pointers are added to improve the robustness of the code and a whitespace error is corrected.
1 parent d6a5174 commit ec2aa32

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

cpuid_riscv64.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,23 +86,29 @@ int detect(void){
8686
char *pmodel = NULL, *pisa = NULL;
8787

8888
infile = fopen("/proc/cpuinfo", "r");
89+
if (!infile)
90+
return CPU_GENERIC;
8991
while (fgets(buffer, sizeof(buffer), infile)){
9092
if(!strncmp(buffer, "model name", 10)){
9193
strcpy(model_buffer, buffer);
92-
pmodel = strchr(isa_buffer, ':') + 1;
94+
pmodel = strchr(model_buffer, ':');
95+
if (pmodel)
96+
pmodel++;
9397
}
9498

9599
if(!strncmp(buffer, "isa", 3)){
96100
strcpy(isa_buffer, buffer);
97-
pisa = strchr(isa_buffer, '4') + 1;
101+
pisa = strchr(isa_buffer, '4');
102+
if (pisa)
103+
pisa++;
98104
}
99105
}
100106

101107
fclose(infile);
102108

103-
if (!pmodel)
109+
if (!pmodel || !pisa)
104110
return(CPU_GENERIC);
105-
111+
106112
if (strstr(pmodel, check_c910_str) && strchr(pisa, 'v'))
107113
return CPU_C910V;
108114

0 commit comments

Comments
 (0)