github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-31 02:24:24 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

remoteproc: xlnx: Only access buffer information if IPI is buffered

Browse Source 
In the receive callback check if message is NULL to prevent
possibility of crash by NULL pointer dereferencing.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Fixes: 5dfb28c257 ("remoteproc: xilinx: Add mailbox channels for rpmsg")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260303235127.2317955-3-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
This commit is contained in:
Ben Levinsky 2026-03-03 15:51:27 -08:00 committed by Mathieu Poirier
parent d20c27dc81
commit 38dd6ccfdf
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/remoteproc/xlnx_r5_remoteproc.c
View File

@ -232,17 +232,19 @@ static void zynqmp_r5_mb_rx_cb(struct mbox_client *cl, void *msg)
ipi = container_of(cl, struct mbox_info, mbox_cl);
/* copy data from ipi buffer to r5_core */
/* copy data from ipi buffer to r5_core if IPI is buffered. */
ipi_msg = (struct zynqmp_ipi_message *)msg;
buf_msg = (struct zynqmp_ipi_message *)ipi->rx_mc_buf;
len = ipi_msg->len;
if (len > IPI_BUF_LEN_MAX) {
dev_warn(cl->dev, "msg size exceeded than %d\n",
IPI_BUF_LEN_MAX);
len = IPI_BUF_LEN_MAX;
if (ipi_msg) {
buf_msg = (struct zynqmp_ipi_message *)ipi->rx_mc_buf;
len = ipi_msg->len;
if (len > IPI_BUF_LEN_MAX) {
dev_warn(cl->dev, "msg size exceeded than %d\n",
IPI_BUF_LEN_MAX);
len = IPI_BUF_LEN_MAX;
}
buf_msg->len = len;
memcpy(buf_msg->data, ipi_msg->data, len);
}
buf_msg->len = len;
memcpy(buf_msg->data, ipi_msg->data, len);
/* received and processed interrupt ack */
if (mbox_send_message(ipi->rx_chan, NULL) < 0)