Messages in this thread | | | Date | Wed, 15 Apr 2020 07:55:02 +0200 | From | Oleksij Rempel <> | Subject | Re: [PATCH V2] mailbox: imx-mailbox: fix scu msg header size check |
| |
On Tue, Apr 14, 2020 at 09:21:15PM +0800, peng.fan@nxp.com wrote: > From: Peng Fan <peng.fan@nxp.com> > > The i.MX8 SCU message header size is the number of "u32" elements, > not "u8", so fix the check. > > Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> > Addresses-Coverity-ID: 1461658 ("Memory - corruptions") > Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Measuring size in mailboxes instead of bytes is really challenging :) I would expect similar issues on other places as well.
Regards, Oleksij
> --- > > V2: > Drop parenthesis, add comment, update err msg. > > drivers/mailbox/imx-mailbox.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c > index 7906624a731c..fd3a9a60416d 100644 > --- a/drivers/mailbox/imx-mailbox.c > +++ b/drivers/mailbox/imx-mailbox.c > @@ -154,12 +154,17 @@ static int imx_mu_scu_tx(struct imx_mu_priv *priv, > > switch (cp->type) { > case IMX_MU_TYPE_TX: > - if (msg->hdr.size > sizeof(*msg)) { > + /* > + * msg->hdr.size specifies the number of u32 words while > + * sizeof yields bytes. > + */ > + > + if (msg->hdr.size > sizeof(*msg) / 4) { > /* > * The real message size can be different to > * struct imx_sc_rpc_msg_max size > */ > - dev_err(priv->dev, "Exceed max msg size (%zu) on TX, got: %i\n", sizeof(*msg), msg->hdr.size); > + dev_err(priv->dev, "Maximal message size (%zu bytes) exceeded on TX; got: %i bytes\n", sizeof(*msg), msg->hdr.size << 2); > return -EINVAL; > } > > @@ -198,9 +203,8 @@ static int imx_mu_scu_rx(struct imx_mu_priv *priv, > imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_RIEn(0)); > *data++ = imx_mu_read(priv, priv->dcfg->xRR[0]); > > - if (msg.hdr.size > sizeof(msg)) { > - dev_err(priv->dev, "Exceed max msg size (%zu) on RX, got: %i\n", > - sizeof(msg), msg.hdr.size); > + if (msg.hdr.size > sizeof(msg) / 4) { > + dev_err(priv->dev, "Maximal message size (%zu bytes) exceeded on RX; got: %i bytes\n", sizeof(msg), msg.hdr.size << 2); > return -EINVAL; > } > > -- > 2.16.4 > >
-- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | [unhandled content-type:application/pgp-signature] | |