From 3400c85f6400dc907d686d319faad25956ac4db1 Mon Sep 17 00:00:00 2001 From: Huisong Li Date: Wed, 28 Aug 2024 18:49:53 +0800 Subject: [PATCH] soc: hisilicon: kunpeng_hccs: Add the check for base address and size of shared memory If the shmem_base_addr from PCCT is zero, hccs_register_pcc_channel will return success. And then driver will access to illegal address when send PCC command. In addition, the size of shared memory used for communication between driver and platform is fixed, namely 64 Bytes which is unchangeable. So add the verification for hardening code. Signed-off-by: Huisong Li Reviewed-by: Jonathan Cameron Signed-off-by: Wei Xu --- drivers/soc/hisilicon/kunpeng_hccs.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/soc/hisilicon/kunpeng_hccs.c b/drivers/soc/hisilicon/kunpeng_hccs.c index 6e88f597f2676..6055e5091cbd0 100644 --- a/drivers/soc/hisilicon/kunpeng_hccs.c +++ b/drivers/soc/hisilicon/kunpeng_hccs.c @@ -170,15 +170,21 @@ static int hccs_register_pcc_channel(struct hccs_dev *hdev) goto err_mbx_channel_free; } - if (pcc_chan->shmem_base_addr) { - cl_info->pcc_comm_addr = ioremap(pcc_chan->shmem_base_addr, - pcc_chan->shmem_size); - if (!cl_info->pcc_comm_addr) { - dev_err(dev, "Failed to ioremap PCC communication region for channel-%u.\n", - hdev->chan_id); - rc = -ENOMEM; - goto err_mbx_channel_free; - } + if (!pcc_chan->shmem_base_addr || + pcc_chan->shmem_size != HCCS_PCC_SHARE_MEM_BYTES) { + dev_err(dev, "The base address or size (%llu) of PCC communication region is invalid.\n", + pcc_chan->shmem_size); + rc = -EINVAL; + goto err_mbx_channel_free; + } + + cl_info->pcc_comm_addr = ioremap(pcc_chan->shmem_base_addr, + pcc_chan->shmem_size); + if (!cl_info->pcc_comm_addr) { + dev_err(dev, "Failed to ioremap PCC communication region for channel-%u.\n", + hdev->chan_id); + rc = -ENOMEM; + goto err_mbx_channel_free; } return 0; -- 2.47.3