From 961d0171a6770d6c68ed9a2ba4c0cc607e141c03 Mon Sep 17 00:00:00 2001
From: Iuliana Prodan <iuliana.prodan@nxp.com>
Date: Thu, 6 Feb 2025 14:00:47 +0200
Subject: [PATCH] io: fix buffer overflow in metal_sys_io_mem_map()

In metal_sys_io_mem_map() if the I/O region size
is a multiple of (1<<page_shift) will result in a
buffer overflow in the for loop.

Therefore, adjust loop termination condition to
prevent accessing an out-of-bounds page.

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
---
 lib/system/freertos/io.c | 2 +-
 lib/system/generic/io.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/system/freertos/io.c b/lib/system/freertos/io.c
index 319322c..5e4e2f9 100644
--- a/lib/system/freertos/io.c
+++ b/lib/system/freertos/io.c
@@ -22,7 +22,7 @@ void metal_sys_io_mem_map(struct metal_io_region *io)
 	if (psize) {
 		if (psize >> io->page_shift)
 			psize = (size_t)1 << io->page_shift;
-		for (p = 0; p <= (io->size >> io->page_shift); p++) {
+		for (p = 0; p <= ((io->size - 1) >> io->page_shift); p++) {
 			metal_machine_io_mem_map(va, io->physmap[p],
 						 psize, io->mem_flags);
 			va += psize;
diff --git a/lib/system/generic/io.c b/lib/system/generic/io.c
index 966bfc5..6fc5bb6 100644
--- a/lib/system/generic/io.c
+++ b/lib/system/generic/io.c
@@ -22,7 +22,7 @@ void metal_sys_io_mem_map(struct metal_io_region *io)
 	if (psize) {
 		if (psize >> io->page_shift)
 			psize = (size_t)1 << io->page_shift;
-		for (p = 0; p <= (io->size >> io->page_shift); p++) {
+		for (p = 0; p <= ((io->size - 1) >> io->page_shift); p++) {
 			metal_machine_io_mem_map(va, io->physmap[p],
 						 psize, io->mem_flags);
 			va += psize;