linux-kernel - [PATCH] PCI: endpoint: epf-mhi: Fix the outbound window offset handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  6 Jun 2023 13:16:57 +0530
From:   Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
To:     lpieralisi@...nel.org, kw@...ux.com
Cc:     kishon@...nel.org, bhelgaas@...gle.com, linux-pci@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-arm-msm@...r.kernel.org,
        Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
Subject: [PATCH] PCI: endpoint: epf-mhi: Fix the outbound window offset handling

__pci_epf_mhi_alloc_map() allocates and maps the PCI outbound window memory
to endpoint local memory. For taking care of alignment restrictions, the
caller needs to specify the address alignment offset. Currently, this
offset is not added to the allocated physical and virtual addresses before
returning from the function.

But __pci_epf_mhi_unmap_free() function substracts the offset before
unmapping and freeing the memory, leading to incorrect unmap and free.

Fix this issue by adding the offset to physical and virtual addresses in
__pci_epf_mhi_alloc_map() itself. This also removes the need to add the
offset while doing memcpy in iatu_{read/write}.

Fixes: fd0fda1ef61a ("PCI: endpoint: Add PCI Endpoint function driver for MHI bus")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
---
 drivers/pci/endpoint/functions/pci-epf-mhi.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-mhi.c b/drivers/pci/endpoint/functions/pci-epf-mhi.c
index f5bbaded49d4..18e46ee446c2 100644
--- a/drivers/pci/endpoint/functions/pci-epf-mhi.c
+++ b/drivers/pci/endpoint/functions/pci-epf-mhi.c
@@ -148,6 +148,9 @@ static int __pci_epf_mhi_alloc_map(struct mhi_ep_cntrl *mhi_cntrl, u64 pci_addr,
 		return ret;
 	}
 
+	*paddr = *paddr + offset;
+	*vaddr = *vaddr + offset;
+
 	return 0;
 }
 
@@ -158,17 +161,9 @@ static int pci_epf_mhi_alloc_map(struct mhi_ep_cntrl *mhi_cntrl, u64 pci_addr,
 	struct pci_epf_mhi *epf_mhi = to_epf_mhi(mhi_cntrl);
 	struct pci_epc *epc = epf_mhi->epf->epc;
 	size_t offset = pci_addr & (epc->mem->window.page_size - 1);
-	int ret;
 
-	ret = __pci_epf_mhi_alloc_map(mhi_cntrl, pci_addr, paddr, vaddr,
+	return __pci_epf_mhi_alloc_map(mhi_cntrl, pci_addr, paddr, vaddr,
 				      offset, size);
-	if (ret)
-		return ret;
-
-	*paddr = *paddr + offset;
-	*vaddr = *vaddr + offset;
-
-	return 0;
 }
 
 static void __pci_epf_mhi_unmap_free(struct mhi_ep_cntrl *mhi_cntrl,
@@ -230,7 +225,7 @@ static int pci_epf_mhi_iatu_read(struct mhi_ep_cntrl *mhi_cntrl, u64 from,
 		return ret;
 	}
 
-	memcpy_fromio(to, tre_buf + offset, size);
+	memcpy_fromio(to, tre_buf, size);
 
 	__pci_epf_mhi_unmap_free(mhi_cntrl, from, tre_phys, tre_buf, offset,
 				 size);
@@ -258,7 +253,7 @@ static int pci_epf_mhi_iatu_write(struct mhi_ep_cntrl *mhi_cntrl,
 		return ret;
 	}
 
-	memcpy_toio(tre_buf + offset, from, size);
+	memcpy_toio(tre_buf, from, size);
 
 	__pci_epf_mhi_unmap_free(mhi_cntrl, to, tre_phys, tre_buf, offset,
 				 size);
-- 
2.25.1