Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   peng.fan@nxp.com
To:     shawnguo@kernel.org, s.hauer@pengutronix.de,
        jassisinghbrar@gmail.com, o.rempel@pengutronix.de,
        leonard.crestez@nxp.com
Cc:     kernel@pengutronix.de, festevam@gmail.com, linux-imx@nxp.com,
        Anson.Huang@nxp.com, aisheng.dong@nxp.com,
        linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
        Peng Fan <peng.fan@nxp.com>
Subject: [PATCH V2] mailbox: imx-mailbox: fix scu msg header size check
Date:   Tue, 14 Apr 2020 21:21:15 +0800
Message-Id: <1586870475-32532-1-git-send-email-peng.fan@nxp.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from localhost.localdomain (119.31.174.67) by SG2PR01CA0133.apcprd01.prod.exchangelabs.com (2603:1096:4:8f::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2900.15 via Frontend Transport; Tue, 14 Apr 2020 13:30:25 +0000
X-Mailer: git-send-email 2.7.4
X-Originating-IP: [119.31.174.67]
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: ff06ce7e-f123-417a-a65a-08d7e077ff89
X-MS-TrafficTypeDiagnostic: AM0PR04MB5233:|AM0PR04MB5233:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <AM0PR04MB52331721C07079D1D540407E88DA0@AM0PR04MB5233.eurprd04.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:2733;
X-Forefront-PRVS: 0373D94D15
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR04MB4481.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(10009020)(4636009)(396003)(376002)(366004)(39860400002)(136003)(346002)(2906002)(4326008)(52116002)(15650500001)(81156014)(5660300002)(8936002)(186003)(8676002)(956004)(478600001)(2616005)(86362001)(66556008)(66476007)(66946007)(9686003)(6506007)(16526019)(6512007)(36756003)(69590400007)(6486002)(316002)(26005)(6666004);DIR:OUT;SFP:1101;
Received-SPF: None (protection.outlook.com: nxp.com does not designate
 permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: hJSqiALtYWp+iqIvwD3xgYJMDYFdk2TPQSC/6j1/gEY6xQWCnkau0KFLJXEzws1uA6CrIeEeMXw7C/YXIRDDFbF4GGm2dBgsmRC5sIS8i8nGi6cAetzFLlqaGKCopKAknSDRrlp79nSrqQ/Wx5VrkEvQbFX1VK+pdZLGYNs7sGhVZkOnRUzIKhQ4egfFdCSBwUocXG49AyRWP3s7cp5fUFYOG7M84luKUXUSz2UV+bc47a57GnqAvybA9YgsgEG+XPTD/ndm6uBuoe0GQu8AzWgzHchxieTPU7yhfHq6gD4Yv8BROpXQob6OjXqxcqBQPThdRUl4C+BiSfxGbxKbbRSpF/MXSLM/vY77Ql3C+8D6Ylz9CrmGqPe8IMDsEG9Fw3Tw9cTvBgRAXi7ki27R3noXKU9ryjURGaF7jKEknMulN+P0CPQbcYBRVRnxt9CnlBLCsW449fQcS7EQ3CHzo5CechaWw6YfWrO337msSjsTADpNPY9mNUHlEqt0ohbQ
X-MS-Exchange-AntiSpam-MessageData: oZ4lEdn8uSStdAGhjvX50PMJk8kHFCbLAEvrVEg15cnSJvrlCgpjRedwStrkJsh6/BVUhN0at8GqI6/K3xn5WAdwn4e5a2pIXwmA96T7E69bVk4WZM+97ifx2oBOjp/sKIkdWkdtjqJJ0Sq6xMRkCQ==
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ff06ce7e-f123-417a-a65a-08d7e077ff89
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2020 13:30:29.1104
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: BT95VsShvhH1jVK09PR3bwFcVYp6JOQDEZ6fnhi4r9y98QaU/EYKZWRUKpruK0QM4GRqGiZ1pNBHWMsPIDOsbw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB5233
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Peng Fan <peng.fan@nxp.com>

The i.MX8 SCU message header size is the number of "u32" elements,
not "u8", so fix the check.

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1461658 ("Memory - corruptions")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---

V2:
 Drop parenthesis, add comment, update err msg.

 drivers/mailbox/imx-mailbox.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
index 7906624a731c..fd3a9a60416d 100644
--- a/drivers/mailbox/imx-mailbox.c
+++ b/drivers/mailbox/imx-mailbox.c
@@ -154,12 +154,17 @@ static int imx_mu_scu_tx(struct imx_mu_priv *priv,
 
 	switch (cp->type) {
 	case IMX_MU_TYPE_TX:
-		if (msg->hdr.size > sizeof(*msg)) {
+		/*
+		 * msg->hdr.size specifies the number of u32 words while
+		 * sizeof yields bytes.
+		 */
+
+		if (msg->hdr.size > sizeof(*msg) / 4) {
 			/*
 			 * The real message size can be different to
 			 * struct imx_sc_rpc_msg_max size
 			 */
-			dev_err(priv->dev, "Exceed max msg size (%zu) on TX, got: %i\n", sizeof(*msg), msg->hdr.size);
+			dev_err(priv->dev, "Maximal message size (%zu bytes) exceeded on TX; got: %i bytes\n", sizeof(*msg), msg->hdr.size << 2);
 			return -EINVAL;
 		}
 
@@ -198,9 +203,8 @@ static int imx_mu_scu_rx(struct imx_mu_priv *priv,
 	imx_mu_xcr_rmw(priv, 0, IMX_MU_xCR_RIEn(0));
 	*data++ = imx_mu_read(priv, priv->dcfg->xRR[0]);
 
-	if (msg.hdr.size > sizeof(msg)) {
-		dev_err(priv->dev, "Exceed max msg size (%zu) on RX, got: %i\n",
-			sizeof(msg), msg.hdr.size);
+	if (msg.hdr.size > sizeof(msg) / 4) {
+		dev_err(priv->dev, "Maximal message size (%zu bytes) exceeded on RX; got: %i bytes\n", sizeof(msg), msg.hdr.size << 2);
 		return -EINVAL;
 	}
 
-- 
2.16.4