From patchwork Tue Feb 23 03:57:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shanker Donthineni X-Patchwork-Id: 8386891 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 301E49F314 for ; Tue, 23 Feb 2016 04:01:17 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 48C8D2067A for ; Tue, 23 Feb 2016 04:01:16 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 488112066E for ; Tue, 23 Feb 2016 04:01:15 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1aY48F-0008GP-1G; Tue, 23 Feb 2016 03:59:27 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1aY48C-0008F2-6n for linux-arm-kernel@lists.infradead.org; Tue, 23 Feb 2016 03:59:24 +0000 Received: from smtp.codeaurora.org (localhost [127.0.0.1]) by smtp.codeaurora.org (Postfix) with ESMTP id 7D98B60895; Tue, 23 Feb 2016 03:59:03 +0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 62B126067A; Tue, 23 Feb 2016 03:59:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from shankerd-ubuntu.qualcomm.com (rrcs-67-52-129-61.west.biz.rr.com [67.52.129.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: shankerd@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 1CA2460224; Tue, 23 Feb 2016 03:59:01 +0000 (UTC) From: Shanker Donthineni To: Marc Zyngier , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] irqchip/gicv3-its: Don't allow devices whose ID is outside range Date: Mon, 22 Feb 2016 21:57:48 -0600 Message-Id: <1456199868-9054-1-git-send-email-shankerd@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-Virus-Scanned: ClamAV using ClamSMTP X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20160222_195924_306908_CD9DC4BC X-CRM114-Status: GOOD ( 15.20 ) X-Spam-Score: -1.9 (-) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Gleixner , Shanker Donthineni , Jason Cooper , Vikram Sethi MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP We are not checking whether the requested device identifier fits into table or not. The ITS MAPD command fails if 'Device ID' is outside of device table range. Add a simple validation check to avoid MAPD failures since we are not handling ITS command errors. This change also helps to return an error -ENOMEM instead of success to caller. Signed-off-by: Shanker Donthineni --- This patch depends on https://git.kernel.org/cgit/linux/kernel/git/maz/arm-platforms.git/commit/?h=irq/gic-4.5-fixes&id=2eca0d6ceea1f108b2d3ac81fb34698c4fd41006 drivers/irqchip/irq-gic-v3-its.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index c0f227a..9bdcdf5 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -70,6 +70,7 @@ struct its_node { struct { void *base; u32 order; + u32 entry_size; } tables[GITS_BASER_NR_REGS]; struct its_collection *collections; struct list_head its_device_list; @@ -880,6 +881,7 @@ static int its_alloc_tables(const char *node_name, struct its_node *its) node_name, order); } } + its->tables[type].entry_size = entry_size; retry_alloc_baser: alloc_pages = (PAGE_ORDER_TO_SIZE(order) / psz); @@ -896,8 +898,8 @@ retry_alloc_baser: goto out_free; } - its->tables[i].base = base; - its->tables[i].order = order; + its->tables[type].base = base; + its->tables[type].order = order; retry_baser: val = (virt_to_phys(base) | @@ -947,7 +949,7 @@ retry_baser: * something is horribly wrong... */ free_pages((unsigned long)base, order); - its->tables[i].base = NULL; + its->tables[type].base = NULL; switch (psz) { case SZ_16K: @@ -1152,12 +1154,22 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id, unsigned long *lpi_map; unsigned long flags; u16 *col_map = NULL; + u8 type = GITS_BASER_TYPE_DEVICE; + u32 entry_size; + u32 order; void *itt; int lpi_base; int nr_lpis; int nr_ites; int sz; + entry_size = its->tables[type].entry_size; + order = its->tables[type].order; + + /* Don't allow 'dev_id' that exceeds single, flat table limit */ + if (dev_id >= (PAGE_ORDER_TO_SIZE(order) / entry_size)) + return NULL; + dev = kzalloc(sizeof(*dev), GFP_KERNEL); /* * At least one bit of EventID is being used, hence a minimum