Skip to content

Commit e9c8dc8

Browse files
Alexey KlimovJassiBrar
authored andcommitted
mailbox: pcc: fix channel calculation in get_pcc_channel()
This patch fixes the calculation of pcc_chan for non-zero id. After the compiler ignores the (unsigned long) cast the pcc_mbox_channels pointer is type-cast and then the type-cast offset is added which results in address outside of the range leading to the kernel crashing. We might add braces and make it: pcc_chan = (struct mbox_chan *) ((unsigned long) pcc_mbox_channels + (id * sizeof(*pcc_chan))); but let's go with array approach here and use id as index. Tested on Juno board. Signed-off-by: Alexey Klimov <[email protected]> Acked-by: Sudeep Holla <[email protected]> Acked-by: Ashwin Chaugule <[email protected]> Signed-off-by: Jassi Brar <[email protected]>
1 parent 34229b2 commit e9c8dc8

File tree

1 file changed

+1
-7
lines changed

1 file changed

+1
-7
lines changed

drivers/mailbox/pcc.c

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -81,16 +81,10 @@ static struct mbox_controller pcc_mbox_ctrl = {};
8181
*/
8282
static struct mbox_chan *get_pcc_channel(int id)
8383
{
84-
struct mbox_chan *pcc_chan;
85-
8684
if (id < 0 || id > pcc_mbox_ctrl.num_chans)
8785
return ERR_PTR(-ENOENT);
8886

89-
pcc_chan = (struct mbox_chan *)
90-
(unsigned long) pcc_mbox_channels +
91-
(id * sizeof(*pcc_chan));
92-
93-
return pcc_chan;
87+
return &pcc_mbox_channels[id];
9488
}
9589

9690
/**

0 commit comments

Comments
 (0)