提交 85bff4c3 编写于 作者: M Marek Vasut 提交者: Lorenzo Pieralisi

PCI: rcar: Move the inbound index check

Since the 'idx' variable value is stored across multiple calls to
rcar_pcie_inbound_ranges() function, and the 'idx' value is used to
index registers which are written, subsequent calls might cause
the 'idx' value to be high enough to trigger writes into nonexistent
registers.

Fix this by moving the 'idx' value check to the beginning of the loop.
Signed-off-by: NMarek Vasut <marek.vasut+renesas@gmail.com>
Signed-off-by: NLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: NAndrew Murray <andrew.murray@arm.com>
Reviewed-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Wolfram Sang <wsa@the-dreams.de>
Cc: linux-renesas-soc@vger.kernel.org
上级 af072edb
......@@ -1046,6 +1046,10 @@ static int rcar_pcie_inbound_ranges(struct rcar_pcie *pcie,
mask &= ~0xf;
while (cpu_addr < cpu_end) {
if (idx >= MAX_NR_INBOUND_MAPS - 1) {
dev_err(pcie->dev, "Failed to map inbound regions!\n");
return -EINVAL;
}
/*
* Set up 64-bit inbound regions as the range parser doesn't
* distinguish between 32 and 64-bit types.
......@@ -1065,11 +1069,6 @@ static int rcar_pcie_inbound_ranges(struct rcar_pcie *pcie,
pci_addr += size;
cpu_addr += size;
idx += 2;
if (idx > MAX_NR_INBOUND_MAPS) {
dev_err(pcie->dev, "Failed to map inbound regions!\n");
return -EINVAL;
}
}
*index = idx;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册