mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 13:55:32 +00:00
Code Issues Releases Wiki Activity

regmap: mmio: Fix the bug of 'offset' value parsing.

Browse source 
'offset = *(u32 *)reg;'
This will be okey for 32/64-bits register device, but for 8/16-bits
register ones, the 'offset' value will overflow, for example:

The IMX2 Watchdog, whose registers and values are all 16-bits:

If the IO base virtual address is ctx->regs = 0x888c0000, and the now
doing the 0x00 register accessing:
Using 'offset = *(u32 *)reg' the offset value will possiblly be 0x77310000,
Using 'offset = *(u16 *)reg' the offset value will be 0x0000.

In the regmap_mmio_gather_write(), ctx->regs + 0x7731000 will be 0xffbd0000,
but actually it should be ctx->regs + 0x0000 = 0x888c0000.

Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
This commit is contained in:
Xiubo Li 2014-04-02 10:20:17 +08:00 committed by Mark Brown
parent c9eaa447e7
commit 88cb32c657
1 changed files with 24 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
drivers/base/regmap/regmap-mmio.c
View file

@ -66,12 +66,31 @@ static inline void regmap_mmio_count_check(size_t count)
BUG_ON(count % 2 != 0);
}
static inline unsigned int
regmap_mmio_get_offset(const void *reg, size_t reg_size)
{
switch (reg_size) {
case 1:
return *(u8 *)reg;
case 2:
return *(u16 *)reg;
case 4:
return *(u32 *)reg;
#ifdef CONFIG_64BIT
case 8:
return *(u64 *)reg;
#endif
default:
BUG();
}
}
static int regmap_mmio_gather_write(void *context,
const void *reg, size_t reg_size,
const void *val, size_t val_size)
{
struct regmap_mmio_context *ctx = context;
u32 offset;
unsigned int offset;
int ret;
regmap_mmio_regsize_check(reg_size);
@ -82,7 +101,7 @@ static int regmap_mmio_gather_write(void *context,
return ret;
}
offset = *(u32 *)reg;
offset = regmap_mmio_get_offset(reg, reg_size);
while (val_size) {
switch (ctx->val_bytes) {
@ -118,7 +137,7 @@ static int regmap_mmio_gather_write(void *context,
static int regmap_mmio_write(void *context, const void *data, size_t count)
{
struct regmap_mmio_context *ctx = context;
u32 offset = ctx->reg_bytes + ctx->pad_bytes;
unsigned int offset = ctx->reg_bytes + ctx->pad_bytes;
regmap_mmio_count_check(count);
@ -131,7 +150,7 @@ static int regmap_mmio_read(void *context,
void *val, size_t val_size)
{
struct regmap_mmio_context *ctx = context;
u32 offset;
unsigned int offset;
int ret;
regmap_mmio_regsize_check(reg_size);
@ -142,7 +161,7 @@ static int regmap_mmio_read(void *context,
return ret;
}
offset = *(u32 *)reg;
offset = regmap_mmio_get_offset(reg, reg_size);
while (val_size) {
switch (ctx->val_bytes) {