Messages in this thread Patch in this message | | | From | peng.fan@nxp ... | Subject | [PATCH] mailbox: imx-mailbox: fix scu msg header size check | Date | Tue, 14 Apr 2020 16:10:26 +0800 |
| |
From: Peng Fan <peng.fan@nxp.com>
The i.MX8 SCU message header size is the number of "u32" elements, not "u8", so fix the check.
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1461658 ("Memory - corruptions") Signed-off-by: Peng Fan <peng.fan@nxp.com> ---
V2: I not include the fixes tag, since this patch still in next tree.
drivers/mailbox/imx-mailbox.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c index 7906624a731c..c2398cb63ea0 100644 --- a/drivers/mailbox/imx-mailbox.c +++ b/drivers/mailbox/imx-mailbox.c @@ -154,12 +154,12 @@ static int imx_mu_scu_tx(struct imx_mu_priv *priv, switch (cp->type) { case IMX_MU_TYPE_TX: - if (msg->hdr.size > sizeof(*msg)) { + if (msg->hdr.size > (sizeof(*msg) / 4)) { /* * The real message size can be different to * struct imx_sc_rpc_msg_max size */ - dev_err(priv->dev, "Exceed max msg size (%zu) on TX, got: %i\n", sizeof(*msg), msg->hdr.size); + dev_err(priv->dev, "Exceed max msg size (%zu) on TX, got: %i\n", sizeof(*msg) / 4, msg->hdr.size); return -EINVAL; } @@ -198,9 +198,9 @@ static int imx_mu_scu_rx(struct imx_mu_priv *priv, imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_RIEn(0)); *data++ = imx_mu_read(priv, priv->dcfg->xRR[0]); - if (msg.hdr.size > sizeof(msg)) { + if (msg.hdr.size > (sizeof(msg) / 4)) { dev_err(priv->dev, "Exceed max msg size (%zu) on RX, got: %i\n", - sizeof(msg), msg.hdr.size); + sizeof(msg) / 4, msg.hdr.size); return -EINVAL; } -- 2.16.4
| |