lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 326/343] dmaengine: imx-sdma: fix size check for sdma script_number
    Date
    From: Robin Gong <yibin.gong@nxp.com>

    [ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]

    Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
    (41) exceed the size of structure sdma_script_start_addrs(40),
    thus cause memory corrupt such as slob block header so that kernel
    trap into while() loop forever in slob_free(). Please refer to below
    code piece in imx-sdma.c:
    for (i = 0; i < sdma->script_number; i++)
    if (addr_arr[i] > 0)
    saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
    That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
    support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
    (38->41 3 scripts added) not align with script number added in
    sdma_script_start_addrs(2 scripts).

    Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
    Cc: stable@vger.kernel
    Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
    Signed-off-by: Robin Gong <yibin.gong@nxp.com>
    Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
    Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
    [vkoul: update the patch title]
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/dma/imx-sdma.c | 8 ++++++++
    include/linux/platform_data/dma-imx-sdma.h | 3 +++
    2 files changed, 11 insertions(+)

    diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
    index 0fc12a8783e39..99f3f22ed6476 100644
    --- a/drivers/dma/imx-sdma.c
    +++ b/drivers/dma/imx-sdma.c
    @@ -1441,6 +1441,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
    if (!sdma->script_number)
    sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;

    + if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
    + / sizeof(s32)) {
    + dev_err(sdma->dev,
    + "SDMA script number %d not match with firmware.\n",
    + sdma->script_number);
    + return;
    + }
    +
    for (i = 0; i < sdma->script_number; i++)
    if (addr_arr[i] > 0)
    saddr_arr[i] = addr_arr[i];
    diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
    index 6eaa53cef0bd2..30e676b36b247 100644
    --- a/include/linux/platform_data/dma-imx-sdma.h
    +++ b/include/linux/platform_data/dma-imx-sdma.h
    @@ -51,7 +51,10 @@ struct sdma_script_start_addrs {
    /* End of v2 array */
    s32 zcanfd_2_mcu_addr;
    s32 zqspi_2_mcu_addr;
    + s32 mcu_2_ecspi_addr;
    /* End of v3 array */
    + s32 mcu_2_zqspi_addr;
    + /* End of v4 array */
    };

    /**
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 11:07    [W:4.196 / U:1.432 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site