mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 16:29:59 +00:00
bd73dfabdd
Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3 (41) exceed the size of structure sdma_script_start_addrs(40), thus cause memory corrupt such as slob block header so that kernel trap into while() loop forever in slob_free(). Please refer to below code piece in imx-sdma.c: for (i = 0; i < sdma->script_number; i++) if (addr_arr[i] > 0) saddr_arr[i] = addr_arr[i]; /* memory corrupt here */ That issue was brought by commita572460be9("dmaengine: imx-sdma: Add support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3 (38->41 3 scripts added) not align with script number added in sdma_script_start_addrs(2 scripts). Fixes:a572460be9("dmaengine: imx-sdma: Add support for version 3 firmware") Cc: stable@vger.kernel Link: https://www.spinics.net/lists/arm-kernel/msg754895.html Signed-off-by: Robin Gong <yibin.gong@nxp.com> Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com> Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com [vkoul: update the patch title] Signed-off-by: Vinod Koul <vkoul@kernel.org>
71 lines
1.6 KiB
C
71 lines
1.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __MACH_MXC_SDMA_H__
|
|
#define __MACH_MXC_SDMA_H__
|
|
|
|
/**
|
|
* struct sdma_script_start_addrs - SDMA script start pointers
|
|
*
|
|
* start addresses of the different functions in the physical
|
|
* address space of the SDMA engine.
|
|
*/
|
|
struct sdma_script_start_addrs {
|
|
s32 ap_2_ap_addr;
|
|
s32 ap_2_bp_addr;
|
|
s32 ap_2_ap_fixed_addr;
|
|
s32 bp_2_ap_addr;
|
|
s32 loopback_on_dsp_side_addr;
|
|
s32 mcu_interrupt_only_addr;
|
|
s32 firi_2_per_addr;
|
|
s32 firi_2_mcu_addr;
|
|
s32 per_2_firi_addr;
|
|
s32 mcu_2_firi_addr;
|
|
s32 uart_2_per_addr;
|
|
s32 uart_2_mcu_addr;
|
|
s32 per_2_app_addr;
|
|
s32 mcu_2_app_addr;
|
|
s32 per_2_per_addr;
|
|
s32 uartsh_2_per_addr;
|
|
s32 uartsh_2_mcu_addr;
|
|
s32 per_2_shp_addr;
|
|
s32 mcu_2_shp_addr;
|
|
s32 ata_2_mcu_addr;
|
|
s32 mcu_2_ata_addr;
|
|
s32 app_2_per_addr;
|
|
s32 app_2_mcu_addr;
|
|
s32 shp_2_per_addr;
|
|
s32 shp_2_mcu_addr;
|
|
s32 mshc_2_mcu_addr;
|
|
s32 mcu_2_mshc_addr;
|
|
s32 spdif_2_mcu_addr;
|
|
s32 mcu_2_spdif_addr;
|
|
s32 asrc_2_mcu_addr;
|
|
s32 ext_mem_2_ipu_addr;
|
|
s32 descrambler_addr;
|
|
s32 dptc_dvfs_addr;
|
|
s32 utra_addr;
|
|
s32 ram_code_start_addr;
|
|
/* End of v1 array */
|
|
s32 mcu_2_ssish_addr;
|
|
s32 ssish_2_mcu_addr;
|
|
s32 hdmi_dma_addr;
|
|
/* End of v2 array */
|
|
s32 zcanfd_2_mcu_addr;
|
|
s32 zqspi_2_mcu_addr;
|
|
s32 mcu_2_ecspi_addr;
|
|
/* End of v3 array */
|
|
s32 mcu_2_zqspi_addr;
|
|
/* End of v4 array */
|
|
};
|
|
|
|
/**
|
|
* struct sdma_platform_data - platform specific data for SDMA engine
|
|
*
|
|
* @fw_name The firmware name
|
|
* @script_addrs SDMA scripts addresses in SDMA ROM
|
|
*/
|
|
struct sdma_platform_data {
|
|
char *fw_name;
|
|
struct sdma_script_start_addrs *script_addrs;
|
|
};
|
|
|
|
#endif /* __MACH_MXC_SDMA_H__ */
|