diff options
| author | Shanker Donthineni <shankerd@codeaurora.org> | 2016-04-06 12:49:24 -0500 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2016-04-07 01:25:28 +0200 |
| commit | 169b38373fd4a7d47cac0e5fdeeae90b8c076f32 (patch) | |
| tree | 1ed872b04c4eef0066efd80d7a92c591499c9850 /drivers/mailbox | |
| parent | f387e5b901adb8352fcdf031bb2c539e390b92e2 (diff) | |
| download | linux-stable-169b38373fd4a7d47cac0e5fdeeae90b8c076f32.tar.gz linux-stable-169b38373fd4a7d47cac0e5fdeeae90b8c076f32.tar.bz2 linux-stable-169b38373fd4a7d47cac0e5fdeeae90b8c076f32.zip | |
mailbox: pcc: Don't access an unmapped memory address space
The acpi_pcc_probe() may end up accessing memory outside of the PCCT
table space causing the kernel panic(). Increment the pcct_entry
pointer after parsing 'HW-reduced Communications Subspace' to fix
the problem. This change also enables the parsing of subtable at
index 0.
Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Acked-by: Ashwin Chaugule <ashwin.chaugule@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/mailbox')
| -rw-r--r-- | drivers/mailbox/pcc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index ac11a9b395d3..9d3955e6ab44 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -367,8 +367,6 @@ static int __init acpi_pcc_probe(void) struct acpi_generic_address *db_reg; struct acpi_pcct_hw_reduced *pcct_ss; pcc_mbox_channels[i].con_priv = pcct_entry; - pcct_entry = (struct acpi_subtable_header *) - ((unsigned long) pcct_entry + pcct_entry->length); /* If doorbell is in system memory cache the virt address */ pcct_ss = (struct acpi_pcct_hw_reduced *)pcct_entry; @@ -376,6 +374,8 @@ static int __init acpi_pcc_probe(void) if (db_reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) pcc_doorbell_vaddr[i] = acpi_os_ioremap(db_reg->address, db_reg->bit_width/8); + pcct_entry = (struct acpi_subtable_header *) + ((unsigned long) pcct_entry + pcct_entry->length); } pcc_mbox_ctrl.num_chans = count; |