Skip to content

Commit 169b383

Browse files
Shanker Donthinenirafaeljw
authored andcommitted
mailbox: pcc: Don't access an unmapped memory address space
The acpi_pcc_probe() may end up accessing memory outside of the PCCT table space causing the kernel panic(). Increment the pcct_entry pointer after parsing 'HW-reduced Communications Subspace' to fix the problem. This change also enables the parsing of subtable at index 0. Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org> Acked-by: Ashwin Chaugule <ashwin.chaugule@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
1 parent f387e5b commit 169b383

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/mailbox/pcc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -367,15 +367,15 @@ static int __init acpi_pcc_probe(void)
367367
struct acpi_generic_address *db_reg;
368368
struct acpi_pcct_hw_reduced *pcct_ss;
369369
pcc_mbox_channels[i].con_priv = pcct_entry;
370-
pcct_entry = (struct acpi_subtable_header *)
371-
((unsigned long) pcct_entry + pcct_entry->length);
372370

373371
/* If doorbell is in system memory cache the virt address */
374372
pcct_ss = (struct acpi_pcct_hw_reduced *)pcct_entry;
375373
db_reg = &pcct_ss->doorbell_register;
376374
if (db_reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
377375
pcc_doorbell_vaddr[i] = acpi_os_ioremap(db_reg->address,
378376
db_reg->bit_width/8);
377+
pcct_entry = (struct acpi_subtable_header *)
378+
((unsigned long) pcct_entry + pcct_entry->length);
379379
}
380380

381381
pcc_mbox_ctrl.num_chans = count;

0 commit comments

Comments
 (0)