Commit b61b04ad authored by Denis Bolotin's avatar Denis Bolotin Committed by David S. Miller

qed: Fix the doorbell address sanity check

Fix the condition which verifies that doorbell address is inside the
doorbell bar by checking that the end of the address is within range
as well.
Signed-off-by: default avatarDenis Bolotin <dbolotin@marvell.com>
Signed-off-by: default avatarMichal Kalderon <mkalderon@marvell.com>
Signed-off-by: default avatarAriel Elior <aelior@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9ac6bb14
...@@ -102,11 +102,15 @@ static void qed_db_recovery_dp_entry(struct qed_hwfn *p_hwfn, ...@@ -102,11 +102,15 @@ static void qed_db_recovery_dp_entry(struct qed_hwfn *p_hwfn,
/* Doorbell address sanity (address within doorbell bar range) */ /* Doorbell address sanity (address within doorbell bar range) */
static bool qed_db_rec_sanity(struct qed_dev *cdev, static bool qed_db_rec_sanity(struct qed_dev *cdev,
void __iomem *db_addr, void *db_data) void __iomem *db_addr,
enum qed_db_rec_width db_width,
void *db_data)
{ {
u32 width = (db_width == DB_REC_WIDTH_32B) ? 32 : 64;
/* Make sure doorbell address is within the doorbell bar */ /* Make sure doorbell address is within the doorbell bar */
if (db_addr < cdev->doorbells || if (db_addr < cdev->doorbells ||
(u8 __iomem *)db_addr > (u8 __iomem *)db_addr + width >
(u8 __iomem *)cdev->doorbells + cdev->db_size) { (u8 __iomem *)cdev->doorbells + cdev->db_size) {
WARN(true, WARN(true,
"Illegal doorbell address: %p. Legal range for doorbell addresses is [%p..%p]\n", "Illegal doorbell address: %p. Legal range for doorbell addresses is [%p..%p]\n",
...@@ -159,7 +163,7 @@ int qed_db_recovery_add(struct qed_dev *cdev, ...@@ -159,7 +163,7 @@ int qed_db_recovery_add(struct qed_dev *cdev,
} }
/* Sanitize doorbell address */ /* Sanitize doorbell address */
if (!qed_db_rec_sanity(cdev, db_addr, db_data)) if (!qed_db_rec_sanity(cdev, db_addr, db_width, db_data))
return -EINVAL; return -EINVAL;
/* Obtain hwfn from doorbell address */ /* Obtain hwfn from doorbell address */
...@@ -205,10 +209,6 @@ int qed_db_recovery_del(struct qed_dev *cdev, ...@@ -205,10 +209,6 @@ int qed_db_recovery_del(struct qed_dev *cdev,
return 0; return 0;
} }
/* Sanitize doorbell address */
if (!qed_db_rec_sanity(cdev, db_addr, db_data))
return -EINVAL;
/* Obtain hwfn from doorbell address */ /* Obtain hwfn from doorbell address */
p_hwfn = qed_db_rec_find_hwfn(cdev, db_addr); p_hwfn = qed_db_rec_find_hwfn(cdev, db_addr);
...@@ -317,7 +317,7 @@ static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn, ...@@ -317,7 +317,7 @@ static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
/* Sanity */ /* Sanity */
if (!qed_db_rec_sanity(p_hwfn->cdev, db_entry->db_addr, if (!qed_db_rec_sanity(p_hwfn->cdev, db_entry->db_addr,
db_entry->db_data)) db_entry->db_width, db_entry->db_data))
return; return;
/* Flush the write combined buffer. Since there are multiple doorbelling /* Flush the write combined buffer. Since there are multiple doorbelling
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment