diff mbox series

[v2,1/3] remoteproc/mediatek: fix boundary check

Message ID 20201116084413.3312631-2-tzungbi@google.com (mailing list archive)
State New, archived
Headers show
Series remoteproc/mediatek: read IPI buffer offset from FW binary | expand

Commit Message

Tzung-Bi Shih Nov. 16, 2020, 8:44 a.m. UTC
It is valid if offset+length == sram_size.

For example, sram_size=100, offset=99, length=1.  Accessing offset 99
with length 1 is valid.

Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
---
 drivers/remoteproc/mtk_scp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Mathieu Poirier Nov. 20, 2020, 11:31 p.m. UTC | #1
On Mon, Nov 16, 2020 at 04:44:11PM +0800, Tzung-Bi Shih wrote:
> It is valid if offset+length == sram_size.
> 
> For example, sram_size=100, offset=99, length=1.  Accessing offset 99
> with length 1 is valid.
> 
> Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
> ---
>  drivers/remoteproc/mtk_scp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
> index a1e23b5f19b9..0abbeb62cf43 100644
> --- a/drivers/remoteproc/mtk_scp.c
> +++ b/drivers/remoteproc/mtk_scp.c
> @@ -408,11 +408,11 @@ static void *scp_da_to_va(struct rproc *rproc, u64 da, size_t len)
>  
>  	if (da < scp->sram_size) {
>  		offset = da;
> -		if (offset >= 0 && (offset + len) < scp->sram_size)
> +		if (offset >= 0 && (offset + len) <= scp->sram_size)
>  			return (void __force *)scp->sram_base + offset;
>  	} else if (scp->dram_size) {
>  		offset = da - scp->dma_addr;
> -		if (offset >= 0 && (offset + len) < scp->dram_size)
> +		if (offset >= 0 && (offset + len) <= scp->dram_size)

Right, I had the same kind of conversation with the TI folks.

Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>

>  			return scp->cpu_addr + offset;
>  	}
>  
> -- 
> 2.29.2.299.gdc1121823c-goog
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
diff mbox series

Patch

diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
index a1e23b5f19b9..0abbeb62cf43 100644
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c
@@ -408,11 +408,11 @@  static void *scp_da_to_va(struct rproc *rproc, u64 da, size_t len)
 
 	if (da < scp->sram_size) {
 		offset = da;
-		if (offset >= 0 && (offset + len) < scp->sram_size)
+		if (offset >= 0 && (offset + len) <= scp->sram_size)
 			return (void __force *)scp->sram_base + offset;
 	} else if (scp->dram_size) {
 		offset = da - scp->dma_addr;
-		if (offset >= 0 && (offset + len) < scp->dram_size)
+		if (offset >= 0 && (offset + len) <= scp->dram_size)
 			return scp->cpu_addr + offset;
 	}