Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 169b3837 authored by Shanker Donthineni's avatar Shanker Donthineni Committed by Rafael J. Wysocki
Browse files

mailbox: pcc: Don't access an unmapped memory address space 



The acpi_pcc_probe() may end up accessing memory outside of the PCCT
table space causing the kernel panic(). Increment the pcct_entry
pointer after parsing 'HW-reduced Communications Subspace' to fix
the problem. This change also enables the parsing of subtable at
index 0.

Signed-off-by: default avatarShanker Donthineni <shankerd@codeaurora.org>
Acked-by: default avatarAshwin Chaugule <ashwin.chaugule@linaro.org>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent f387e5b9

drivers/mailbox/pcc.c

+2 −2
Original line number Diff line number Diff line
@@ -367,8 +367,6 @@ static int __init acpi_pcc_probe(void) 
		struct acpi_generic_address *db_reg;

		struct acpi_pcct_hw_reduced *pcct_ss;

		pcc_mbox_channels[i].con_priv = pcct_entry;

		pcct_entry = (struct acpi_subtable_header *)

			((unsigned long) pcct_entry + pcct_entry->length);



		/* If doorbell is in system memory cache the virt address */

		pcct_ss = (struct acpi_pcct_hw_reduced *)pcct_entry;
@@ -376,6 +374,8 @@ static int __init acpi_pcc_probe(void) 
		if (db_reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)

			pcc_doorbell_vaddr[i] = acpi_os_ioremap(db_reg->address,

							db_reg->bit_width/8);

		pcct_entry = (struct acpi_subtable_header *)

			((unsigned long) pcct_entry + pcct_entry->length);

	}



	pcc_mbox_ctrl.num_chans = count;