Commit 23cff2fc authored by Huisong Li's avatar Huisong Li Committed by Dengdui Huang
Browse files

soc: hisilicon: kunpeng_hccs: Add the check for base address and size of shared memory 

mainline inclusion
from mainline-v6.13-rc1
commit 3400c85f6400dc907d686d319faad25956ac4db1
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB75RW
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3400c85f6400dc907d686d319faad25956ac4db1



--------------------------------

If the shmem_base_addr from PCCT is zero, hccs_register_pcc_channel will
return success. And then driver will access to illegal address when send
PCC command. In addition, the size of shared memory used for communication
between driver and platform is fixed, namely 64 Bytes which is
unchangeable. So add the verification for hardening code.

Signed-off-by: default avatarHuisong Li <lihuisong@huawei.com>
Reviewed-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarWei Xu <xuwei5@hisilicon.com>
Signed-off-by: default avatarDengdui Huang <huangdengdui@huawei.com>
parent 5a37e4dd

drivers/soc/hisilicon/kunpeng_hccs.c

+15 −9
Original line number Diff line number Diff line
@@ -170,7 +170,14 @@ static int hccs_register_pcc_channel(struct hccs_dev *hdev) 
		goto err_mbx_channel_free;

	}



	if (pcc_chan->shmem_base_addr) {

	if (!pcc_chan->shmem_base_addr ||

	    pcc_chan->shmem_size != HCCS_PCC_SHARE_MEM_BYTES) {

		dev_err(dev, "The base address or size (%llu) of PCC communication region is invalid.\n",

			pcc_chan->shmem_size);

		rc = -EINVAL;

		goto err_mbx_channel_free;

	}



	cl_info->pcc_comm_addr = ioremap(pcc_chan->shmem_base_addr,

					 pcc_chan->shmem_size);

	if (!cl_info->pcc_comm_addr) {
@@ -179,7 +186,6 @@ static int hccs_register_pcc_channel(struct hccs_dev *hdev) 
		rc = -ENOMEM;

		goto err_mbx_channel_free;

	}

	}



	return 0;