From patchwork Mon May 31 13:14:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 450517 Delivered-To: patch@linaro.org Received: by 2002:a02:c735:0:0:0:0:0 with SMTP id h21csp898588jao; Mon, 31 May 2021 07:54:12 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx4b3woKWGIODCOC2fuXCaFkwK6gjrrdm2HKXGQqjadbQYUiAJrzWNv30iN1K/EkFhPAEoT X-Received: by 2002:a17:906:f117:: with SMTP id gv23mr9927398ejb.432.1622472852293; Mon, 31 May 2021 07:54:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1622472852; cv=none; d=google.com; s=arc-20160816; b=hJNlAwdMsq8JLzXJPFSau3XI0HhM/tQyHX4IoUbyaNkSLkkwK6EeY6RAZKjaql/S7z xp6SQM3HKeuZHbfmeQh7kDKeCo40cn9Ylp+6dWszKC8aCCLepfWa1YgMqDaEDEd/JmZv 5VRbNuiQcIIK851GAGkeky2goE2K3kSktK+N9y/UVD88wFANLIfODNPj9gvSsJjXfoEP mhQSnNgNpKpoobNj0yFKJ5iy5j8A8j+XFV7MnCq1yCL3juV6EK51+/wfzqukuS+3IMmT XBcGyyrGpdbDVf9pymh4gFfPb/IIkmPEumNpE6qatIPebN+EyHszDQ6LP6+k1CKSKZIQ EFWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=g55FBY5ZMP/DedK0Rd+ppfSo29xBtjDLTtc/FDUxZ3E=; b=qNYduwOHvYztS1w7NM1VvaJ3oMpbaSj1dsYn1JhXo3ODzlX7buPUxazfgXCW0qay8h 5bj9neIhd25F77Ye4Zjgarh2I4JZShuoP+6gSBDOI/Rb/jiBNohxlyjK6cTeEIDDFLT0 JbUoQ/wU3ynXM4WM8b/mBjJGnIg8GZ2V+5UqihTW9GFQESKt6OBO4cflj950eQmcym7W 8WsRFEML3kLXIvJQMQajLL04NAnPO6op7/aYWF4z5Z7AV5buksghh++tDapUZNXHALuy ML+ixgto4Cqi9khYKCF4GCGGeYspv6ZgTnPVIwGY180Zwe4FWH7p2kx2cPixJTFjFq9t ZxKw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=O7gc7ZzP; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id f25si14906292ejh.388.2021.05.31.07.54.12; Mon, 31 May 2021 07:54:12 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=O7gc7ZzP; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234362AbhEaOzh (ORCPT + 12 others); Mon, 31 May 2021 10:55:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:47912 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234041AbhEaOxQ (ORCPT ); Mon, 31 May 2021 10:53:16 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id D51AB61CAB; Mon, 31 May 2021 13:58:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1622469519; bh=8VXHNWCK7AGK9cnWLvPrdHbOKwzor6W1humTzPDrbf8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O7gc7ZzPaS+OoSu5ANF7O/z9Wjb+hmCdCRv5tf+0DKsPSRKLIRcaKrVt4zQbKPiL+ 5tGyo3Uz62JL1JzajpyxNUzPrtTzmEY7YMPFy1mTq8e3UWSeVtFy552gUasqruP0B2 iaSV7o3lh8k/9tLp7hz/gcfbtydydOBobSnU2Zas= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Elder , "David S. Miller" , Sasha Levin Subject: [PATCH 5.12 228/296] net: ipa: memory region array is variable size Date: Mon, 31 May 2021 15:14:43 +0200 Message-Id: <20210531130711.487772273@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210531130703.762129381@linuxfoundation.org> References: <20210531130703.762129381@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alex Elder [ Upstream commit 440c3247cba3d9433ac435d371dd7927d68772a7 ] IPA configuration data includes an array of memory region descriptors. That was a fixed-size array at one time, but at some point we started defining it such that it was only as big as required for a given platform. The actual number of entries in the array is recorded in the configuration data along with the array. A loop in ipa_mem_config() still assumes the array has entries for all defined memory region IDs. As a result, this loop can go past the end of the actual array and attempt to write "canary" values based on nonsensical data. Fix this, by stashing the number of entries in the array, and using that rather than IPA_MEM_COUNT in the initialization loop found in ipa_mem_config(). The only remaining use of IPA_MEM_COUNT is in a validation check to ensure configuration data doesn't have too many entries. That's fine for now. Fixes: 3128aae8c439a ("net: ipa: redefine struct ipa_mem_data") Signed-off-by: Alex Elder Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ipa/ipa.h | 2 ++ drivers/net/ipa/ipa_mem.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) -- 2.30.2 diff --git a/drivers/net/ipa/ipa.h b/drivers/net/ipa/ipa.h index 802077631371..2734a5164b92 100644 --- a/drivers/net/ipa/ipa.h +++ b/drivers/net/ipa/ipa.h @@ -56,6 +56,7 @@ enum ipa_flag { * @mem_virt: Virtual address of IPA-local memory space * @mem_offset: Offset from @mem_virt used for access to IPA memory * @mem_size: Total size (bytes) of memory at @mem_virt + * @mem_count: Number of entries in the mem array * @mem: Array of IPA-local memory region descriptors * @imem_iova: I/O virtual address of IPA region in IMEM * @imem_size; Size of IMEM region @@ -102,6 +103,7 @@ struct ipa { void *mem_virt; u32 mem_offset; u32 mem_size; + u32 mem_count; const struct ipa_mem *mem; unsigned long imem_iova; diff --git a/drivers/net/ipa/ipa_mem.c b/drivers/net/ipa/ipa_mem.c index f25029b9ec85..c1294d7ebdad 100644 --- a/drivers/net/ipa/ipa_mem.c +++ b/drivers/net/ipa/ipa_mem.c @@ -181,7 +181,7 @@ int ipa_mem_config(struct ipa *ipa) * for the region, write "canary" values in the space prior to * the region's base address. */ - for (mem_id = 0; mem_id < IPA_MEM_COUNT; mem_id++) { + for (mem_id = 0; mem_id < ipa->mem_count; mem_id++) { const struct ipa_mem *mem = &ipa->mem[mem_id]; u16 canary_count; __le32 *canary; @@ -488,6 +488,7 @@ int ipa_mem_init(struct ipa *ipa, const struct ipa_mem_data *mem_data) ipa->mem_size = resource_size(res); /* The ipa->mem[] array is indexed by enum ipa_mem_id values */ + ipa->mem_count = mem_data->local_count; ipa->mem = mem_data->local; ret = ipa_imem_init(ipa, mem_data->imem_addr, mem_data->imem_size);