From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754630AbbLJR3V (ORCPT ); Thu, 10 Dec 2015 12:29:21 -0500 Received: from foss.arm.com ([217.140.101.70]:56587 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753571AbbLJR3T (ORCPT ); Thu, 10 Dec 2015 12:29:19 -0500 From: Alexey Klimov To: jassisinghbrar@gmail.com, ashwin.chaugule@linaro.org Cc: alexey.klimov@arm.com, sudeep.holla@arm.com, linux-kernel@vger.kernel.org Subject: [PATCH] mailbox: pcc: fix channel calculation in get_pcc_channel() Date: Thu, 10 Dec 2015 17:28:37 +0000 Message-Id: <1449768517-1695-1-git-send-email-alexey.klimov@arm.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch fixes the calculation of pcc_chan for non-zero id. After the compiler ignores the (unsigned long) cast the pcc_mbox_channels pointer is type-cast and then the type-cast offset is added which results in address outside of the range leading to the kernel crashing. We might add braces and make it: pcc_chan = (struct mbox_chan *) ((unsigned long) pcc_mbox_channels + (id * sizeof(*pcc_chan))); but let's go with array approach here and use id as index. Tested on Juno board. Acked-by: Sudeep Holla Signed-off-by: Alexey Klimov --- drivers/mailbox/pcc.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c index 45d85ae..8f779a1 100644 --- a/drivers/mailbox/pcc.c +++ b/drivers/mailbox/pcc.c @@ -81,16 +81,10 @@ static struct mbox_controller pcc_mbox_ctrl = {}; */ static struct mbox_chan *get_pcc_channel(int id) { - struct mbox_chan *pcc_chan; - if (id < 0 || id > pcc_mbox_ctrl.num_chans) return ERR_PTR(-ENOENT); - pcc_chan = (struct mbox_chan *) - (unsigned long) pcc_mbox_channels + - (id * sizeof(*pcc_chan)); - - return pcc_chan; + return &pcc_mbox_channels[id]; } /** -- 1.9.1