4caae8168d
[ Upstream commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 ] Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable@vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang@google.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| arm_mhu.c | ||
| arm_mhu_db.c | ||
| arm_mhuv2.c | ||
| arm_mhuv3.c | ||
| armada-37xx-rwtm-mailbox.c | ||
| ast2700-mailbox.c | ||
| bcm-flexrm-mailbox.c | ||
| bcm-pdc-mailbox.c | ||
| bcm2835-mailbox.c | ||
| bcm74110-mailbox.c | ||
| cix-mailbox.c | ||
| cv1800-mailbox.c | ||
| exynos-mailbox.c | ||
| hi3660-mailbox.c | ||
| hi6220-mailbox.c | ||
| imx-mailbox.c | ||
| mailbox-altera.c | ||
| mailbox-mchp-ipc-sbi.c | ||
| mailbox-mpfs.c | ||
| mailbox-sti.c | ||
| mailbox-test.c | ||
| mailbox-th1520.c | ||
| mailbox-xgene-slimpro.c | ||
| mailbox.c | ||
| mailbox.h | ||
| mtk-adsp-mailbox.c | ||
| mtk-cmdq-mailbox.c | ||
| mtk-gpueb-mailbox.c | ||
| omap-mailbox.c | ||
| pcc.c | ||
| pl320-ipc.c | ||
| platform_mhu.c | ||
| qcom-apcs-ipc-mailbox.c | ||
| qcom-cpucp-mbox.c | ||
| qcom-ipcc.c | ||
| riscv-sbi-mpxy-mbox.c | ||
| rockchip-mailbox.c | ||
| sprd-mailbox.c | ||
| stm32-ipcc.c | ||
| sun6i-msgbox.c | ||
| tegra-hsp.c | ||
| ti-msgmgr.c | ||
| zynqmp-ipi-mailbox.c | ||