Merge "mhi: core: Add checks for bhi and bhie offsets"
diff --git a/drivers/bus/mhi/controllers/mhi_qcom.c b/drivers/bus/mhi/controllers/mhi_qcom.c
index 61de2b1..715fa86 100644
--- a/drivers/bus/mhi/controllers/mhi_qcom.c
+++ b/drivers/bus/mhi/controllers/mhi_qcom.c
@@ -124,6 +124,7 @@
MHI_CNTRL_ERR("Error ioremap region\n");
goto error_ioremap;
}
+ mhi_cntrl->len = len;
ret = pci_alloc_irq_vectors(pci_dev, mhi_cntrl->msi_required,
mhi_cntrl->msi_required, PCI_IRQ_MSI);
diff --git a/drivers/bus/mhi/core/mhi_pm.c b/drivers/bus/mhi/core/mhi_pm.c
index a4e63bc..d86107b 100644
--- a/drivers/bus/mhi/core/mhi_pm.c
+++ b/drivers/bus/mhi/core/mhi_pm.c
@@ -947,6 +947,12 @@
goto error_bhi_offset;
}
+ if (val >= mhi_cntrl->len) {
+ write_unlock_irq(&mhi_cntrl->pm_lock);
+ MHI_ERR("Invalid bhi offset:%x\n", val);
+ goto error_bhi_offset;
+ }
+
mhi_cntrl->bhi = mhi_cntrl->regs + val;
/* setup bhie offset if not set */
@@ -958,6 +964,12 @@
goto error_bhi_offset;
}
+ if (val >= mhi_cntrl->len) {
+ write_unlock_irq(&mhi_cntrl->pm_lock);
+ MHI_ERR("Invalid bhie offset:%x\n", val);
+ goto error_bhi_offset;
+ }
+
mhi_cntrl->bhie = mhi_cntrl->regs + val;
}
diff --git a/drivers/net/wireless/cnss2/pci.c b/drivers/net/wireless/cnss2/pci.c
index cc94890..6a91e49 100644
--- a/drivers/net/wireless/cnss2/pci.c
+++ b/drivers/net/wireless/cnss2/pci.c
@@ -4288,8 +4288,10 @@
mhi_ctrl->fw_image_fallback = plat_priv->fw_fallback_name;
mhi_ctrl->regs = pci_priv->bar;
- cnss_pr_dbg("BAR starts at %pa\n",
- &pci_resource_start(pci_priv->pci_dev, PCI_BAR_NUM));
+ mhi_ctrl->len = pci_resource_len(pci_priv->pci_dev, PCI_BAR_NUM);
+ cnss_pr_dbg("BAR starts at %pa, len-%x\n",
+ &pci_resource_start(pci_priv->pci_dev, PCI_BAR_NUM),
+ mhi_ctrl->len);
ret = cnss_pci_get_mhi_msi(pci_priv);
if (ret) {
diff --git a/include/linux/mhi.h b/include/linux/mhi.h
index 547beaf..51a5ec4 100644
--- a/include/linux/mhi.h
+++ b/include/linux/mhi.h
@@ -260,6 +260,7 @@
/* mmio base */
phys_addr_t base_addr;
+ unsigned int len;
void __iomem *regs;
void __iomem *bhi;
void __iomem *bhie;