Skip to content

Commit 85bff4c

Browse files
Marek VasutLorenzo Pieralisi
authored andcommitted
PCI: rcar: Move the inbound index check
Since the 'idx' variable value is stored across multiple calls to rcar_pcie_inbound_ranges() function, and the 'idx' value is used to index registers which are written, subsequent calls might cause the 'idx' value to be high enough to trigger writes into nonexistent registers. Fix this by moving the 'idx' value check to the beginning of the loop. Signed-off-by: Marek Vasut <[email protected]> Signed-off-by: Lorenzo Pieralisi <[email protected]> Reviewed-by: Andrew Murray <[email protected]> Reviewed-by: Yoshihiro Shimoda <[email protected]> Cc: Geert Uytterhoeven <[email protected]> Cc: Lorenzo Pieralisi <[email protected]> Cc: Wolfram Sang <[email protected]> Cc: [email protected]
1 parent af072ed commit 85bff4c

File tree

1 file changed

+4
-5
lines changed

1 file changed

+4
-5
lines changed

drivers/pci/controller/pcie-rcar.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1046,6 +1046,10 @@ static int rcar_pcie_inbound_ranges(struct rcar_pcie *pcie,
10461046
mask &= ~0xf;
10471047

10481048
while (cpu_addr < cpu_end) {
1049+
if (idx >= MAX_NR_INBOUND_MAPS - 1) {
1050+
dev_err(pcie->dev, "Failed to map inbound regions!\n");
1051+
return -EINVAL;
1052+
}
10491053
/*
10501054
* Set up 64-bit inbound regions as the range parser doesn't
10511055
* distinguish between 32 and 64-bit types.
@@ -1065,11 +1069,6 @@ static int rcar_pcie_inbound_ranges(struct rcar_pcie *pcie,
10651069
pci_addr += size;
10661070
cpu_addr += size;
10671071
idx += 2;
1068-
1069-
if (idx > MAX_NR_INBOUND_MAPS) {
1070-
dev_err(pcie->dev, "Failed to map inbound regions!\n");
1071-
return -EINVAL;
1072-
}
10731072
}
10741073
*index = idx;
10751074

0 commit comments

Comments
 (0)