• Alex Elder's avatar
    net: ipa: memory region array is variable size · 440c3247
    Alex Elder authored
    IPA configuration data includes an array of memory region
    descriptors.  That was a fixed-size array at one time, but
    at some point we started defining it such that it was only
    as big as required for a given platform.  The actual number
    of entries in the array is recorded in the configuration data
    along with the array.
    
    A loop in ipa_mem_config() still assumes the array has entries
    for all defined memory region IDs.  As a result, this loop can
    go past the end of the actual array and attempt to write
    "canary" values based on nonsensical data.
    
    Fix this, by stashing the number of entries in the array, and
    using that rather than IPA_MEM_COUNT in the initialization loop
    found in ipa_mem_config().
    
    The only remaining use of IPA_MEM_COUNT is in a validation check
    to ensure configuration data doesn't have too many entries.
    That's fine for now.
    
    Fixes: 3128aae8 ("net: ipa: redefine struct ipa_mem_data")
    Signed-off-by: default avatarAlex Elder <elder@linaro.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    440c3247
ipa.h 5.41 KB