diff mbox series

[4.9,59/80] remoteproc: Fix wrong rvring index computation

Message ID	20200501131531.273408824@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=1/SS=6P=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Clement Leger <cleger@kalray.eu>, Bjorn Andersson <bjorn.andersson@linaro.org>, Doug Anderson <dianders@chromium.org> Subject: [PATCH 4.9 59/80] remoteproc: Fix wrong rvring index computation Date: Fri, 1 May 2020 15:21:53 +0200 Message-Id: <20200501131531.273408824@linuxfoundation.org> In-Reply-To: <20200501131513.810761598@linuxfoundation.org> References: <20200501131513.810761598@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [4.9,02/80] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() [4.9,05/80] crypto: mxs-dcp - make symbols sha1_null_hash and sha256_null_hash static [4.9,06/80] vti4: removed duplicate log message. [4.9,10/80] ceph: dont skip updating wanted caps when cap is stale [4.9,11/80] pwm: rcar: Fix late Runtime PM enablement [4.9,13/80] ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() [4.9,14/80] kernel/gcov/fs.c: gcov_seq_next() should increase position index [4.9,19/80] PCI/ASPM: Allow re-enabling Clock PM [4.9,20/80] ipv6: fix restrict IPV6_ADDRFORM operation [4.9,21/80] macsec: avoid to set wrong mtu [4.9,22/80] macvlan: fix null dereference in macvlan_device_event() [4.9,23/80] net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node [4.9,25/80] tcp: cache line align MAX_TCP_HEADER [4.9,27/80] net: dsa: b53: Fix ARL register definitions [4.9,28/80] xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish [4.9,31/80] iio: xilinx-xadc: Fix clearing interrupt when enabling trigger [4.9,32/80] iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode [4.9,38/80] overflow.h: Add arithmetic shift helper [4.9,41/80] ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif [4.9,43/80] tpm/tpm_tis: Free IRQ if probing fails [4.9,44/80] KVM: Check validity of resolved slot when searching memslots [4.9,45/80] KVM: VMX: Enable machine check support for 32bit targets [4.9,46/80] tty: hvc: fix buffer overflow during hvc_alloc(). [4.9,48/80] usb-storage: Add unusual_devs entry for JMicron JMS566 [4.9,54/80] staging: vt6656: Fix drivers TBTT timing counter. [4.9,55/80] staging: vt6656: Power save stop wake_up_count wrap around. [4.9,57/80] UAS: fix deadlock in error handling and PM flushing work [4.9,59/80] remoteproc: Fix wrong rvring index computation [4.9,60/80] fuse: fix possibly missed wake-up after abort [4.9,63/80] nfsd: memory corruption in nfsd4_lock() [4.9,64/80] net/cxgb4: Check the return from t4_query_params properly [4.9,65/80] perf/core: fix parent pid/tid in task exit events [4.9,66/80] bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B [4.9,68/80] scsi: target: fix PR IN / READ FULL STATUS for FC [4.9,69/80] objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings [4.9,71/80] xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status [4.9,74/80] hwmon: (jc42) Fix name to have no illegal characters [4.9,77/80] ext4: dont perform block validity checks on the journal inode [4.9,79/80] ext4: unsigned int compared against zero

Commit Message

gregkh@linuxfoundation.org May 1, 2020, 1:21 p.m. UTC

From: Clement Leger <cleger@kalray.eu>

commit 00a0eec59ddbb1ce966b19097d8a8d2f777e726a upstream.

Index of rvring is computed using pointer arithmetic. However, since
rvring->rvdev->vring is the base of the vring array, computation
of rvring idx should be reversed. It previously lead to writing at negative
indices in the resource table.

Signed-off-by: Clement Leger <cleger@kalray.eu>
Link: https://lore.kernel.org/r/20191004073736.8327-1-cleger@kalray.eu
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Doug Anderson <dianders@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/remoteproc/remoteproc_core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -284,7 +284,7 @@  void rproc_free_vring(struct rproc_vring
 {
 	int size = PAGE_ALIGN(vring_size(rvring->len, rvring->align));
 	struct rproc *rproc = rvring->rvdev->rproc;
-	int idx = rvring->rvdev->vring - rvring;
+	int idx = rvring - rvring->rvdev->vring;
 	struct fw_rsc_vdev *rsc;
 
 	dma_free_coherent(rproc->dev.parent, size, rvring->va, rvring->dma);