Skip to content

Commit

Permalink
mailbox: pcc: Don't access an unmapped memory address space
Browse files Browse the repository at this point in the history
The acpi_pcc_probe() may end up accessing memory outside of the PCCT
table space causing the kernel panic(). Increment the pcct_entry
pointer after parsing 'HW-reduced Communications Subspace' to fix
the problem. This change also enables the parsing of subtable at
index 0.

Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Acked-by: Ashwin Chaugule <ashwin.chaugule@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  • Loading branch information
Shanker Donthineni authored and Rafael J. Wysocki committed Apr 6, 2016
1 parent f387e5b commit 169b383
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/mailbox/pcc.c
Original file line number Diff line number Diff line change
Expand Up @@ -367,15 +367,15 @@ static int __init acpi_pcc_probe(void)
struct acpi_generic_address *db_reg;
struct acpi_pcct_hw_reduced *pcct_ss;
pcc_mbox_channels[i].con_priv = pcct_entry;
pcct_entry = (struct acpi_subtable_header *)
((unsigned long) pcct_entry + pcct_entry->length);

/* If doorbell is in system memory cache the virt address */
pcct_ss = (struct acpi_pcct_hw_reduced *)pcct_entry;
db_reg = &pcct_ss->doorbell_register;
if (db_reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
pcc_doorbell_vaddr[i] = acpi_os_ioremap(db_reg->address,
db_reg->bit_width/8);
pcct_entry = (struct acpi_subtable_header *)
((unsigned long) pcct_entry + pcct_entry->length);
}

pcc_mbox_ctrl.num_chans = count;
Expand Down

0 comments on commit 169b383

Please sign in to comment.