From 9585477b0d08c80585af23eee969cf72262de0dc Mon Sep 17 00:00:00 2001 From: Xihai Zhu Date: Wed, 18 Sep 2019 22:04:02 -0400 Subject: [PATCH] amvecm: add addr protect for register program [1/1] PD#SWPL-14333 Problem: invalid address is allowed for register program which cause kernel panic Solution: add protection, programming on invalid addr will be terminated Verify: tl1 Change-Id: I44bedec256ee5c386b53188fb2d8e40ae8c3f553 Signed-off-by: Xihai Zhu --- drivers/amlogic/iomap/iomap.c | 12 +++++++++-- .../common/arch/registers/register_map.c | 20 +++++++++++++++---- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/drivers/amlogic/iomap/iomap.c b/drivers/amlogic/iomap/iomap.c index 2998450a9b1b..c6c00413ed78 100644 --- a/drivers/amlogic/iomap/iomap.c +++ b/drivers/amlogic/iomap/iomap.c @@ -38,10 +38,14 @@ static const struct of_device_id iomap_dt_match[] = { }; static void __iomem *meson_reg_map[IO_BUS_MAX] = { NULL }; +static uint meson_reg_max[IO_BUS_MAX] = { 0 }; inline int aml_reg_read(u32 bus_type, unsigned int reg, unsigned int *val) { - if (bus_type < IO_BUS_MAX && (meson_reg_map[bus_type] != NULL)) { + if ( + bus_type < IO_BUS_MAX && + (meson_reg_map[bus_type]) && + (meson_reg_max[bus_type] >= reg)) { *val = readl((meson_reg_map[bus_type]+reg)); return 0; } else @@ -51,7 +55,10 @@ EXPORT_SYMBOL(aml_reg_read); inline int aml_reg_write(u32 bus_type, unsigned int reg, unsigned int val) { - if (bus_type < IO_BUS_MAX && (meson_reg_map[bus_type] != NULL)) { + if ( + bus_type < IO_BUS_MAX && + (meson_reg_map[bus_type]) && + (meson_reg_max[bus_type] >= reg)) { writel(val, (meson_reg_map[bus_type]+reg)); return 0; } else @@ -281,6 +288,7 @@ static int iomap_probe(struct platform_device *pdev) if (of_address_to_resource(child, 0, &res)) return -1; meson_reg_map[i] = ioremap(res.start, resource_size(&res)); + meson_reg_max[i] = res.end - res.start; i++; } pr_info("amlogic iomap probe done\n"); diff --git a/drivers/amlogic/media/common/arch/registers/register_map.c b/drivers/amlogic/media/common/arch/registers/register_map.c index 390d0dbee951..62d968ef41ff 100644 --- a/drivers/amlogic/media/common/arch/registers/register_map.c +++ b/drivers/amlogic/media/common/arch/registers/register_map.c @@ -50,12 +50,18 @@ enum { }; static void __iomem *codecio_reg_map[CODECIO_BUS_MAX]; +static u32 codecio_reg_max[CODECIO_BUS_MAX]; static inline int codecio_reg_read(u32 bus_type, u32 reg, u32 *val) { if (bus_type < CODECIO_BUS_MAX) { - if (codecio_reg_map[bus_type] == NULL) { - pr_err("No support bus type %d to read.\n", bus_type); + if ( + (!codecio_reg_map[bus_type]) || + (codecio_reg_max[bus_type] < reg)) { + pr_err( + "Not supported bus type %d or addr %x to read.\n", + bus_type, + reg); return -1; } @@ -68,8 +74,13 @@ static inline int codecio_reg_read(u32 bus_type, u32 reg, u32 *val) static inline int codecio_reg_write(u32 bus_type, u32 reg, u32 val) { if (bus_type < CODECIO_BUS_MAX) { - if (codecio_reg_map[bus_type] == NULL) { - pr_err("No support bus type %d to write.\n", bus_type); + if ( + (!codecio_reg_map[bus_type]) || + (codecio_reg_max[bus_type] < reg)) { + pr_err( + "Not supported bus type %d or addr %x to write.\n", + bus_type, + reg); return -1; } @@ -380,6 +391,7 @@ static int codec_io_probe(struct platform_device *pdev) pr_debug("ignore io source start %p,size=%d\n", (void *)res.start, (int)resource_size(&res)); } + codecio_reg_max[i] = res.end - res.start; i++; } /*pr_info("amlogic codec_io probe done\n"); */ -- 2.20.1