linux/drivers/firmware/imx/imx-dsp.c
Hao Ge 1558b1a8dd firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
dsp_chan->name and chan_name points to same block of memory,
because dev_err still needs to be used it,so we need free
it's memory after use to avoid use_after_free.

Fixes: e527adfb9b ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
Signed-off-by: Hao Ge <gehao@kylinos.cn>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2023-10-10 10:30:29 +08:00

192 lines
4.2 KiB
C

// SPDX-License-Identifier: GPL-2.0+
/*
* Copyright 2019 NXP
* Author: Daniel Baluta <daniel.baluta@nxp.com>
*
* Implementation of the DSP IPC interface (host side)
*/
#include <linux/firmware/imx/dsp.h>
#include <linux/kernel.h>
#include <linux/mailbox_client.h>
#include <linux/module.h>
#include <linux/platform_device.h>
#include <linux/slab.h>
/*
* imx_dsp_ring_doorbell - triggers an interrupt on the other side (DSP)
*
* @dsp: DSP IPC handle
* @chan_idx: index of the channel where to trigger the interrupt
*
* Returns non-negative value for success, negative value for error
*/
int imx_dsp_ring_doorbell(struct imx_dsp_ipc *ipc, unsigned int idx)
{
int ret;
struct imx_dsp_chan *dsp_chan;
if (idx >= DSP_MU_CHAN_NUM)
return -EINVAL;
dsp_chan = &ipc->chans[idx];
ret = mbox_send_message(dsp_chan->ch, NULL);
if (ret < 0)
return ret;
return 0;
}
EXPORT_SYMBOL(imx_dsp_ring_doorbell);
/*
* imx_dsp_handle_rx - rx callback used by imx mailbox
*
* @c: mbox client
* @msg: message received
*
* Users of DSP IPC will need to privde handle_reply and handle_request
* callbacks.
*/
static void imx_dsp_handle_rx(struct mbox_client *c, void *msg)
{
struct imx_dsp_chan *chan = container_of(c, struct imx_dsp_chan, cl);
if (chan->idx == 0) {
chan->ipc->ops->handle_reply(chan->ipc);
} else {
chan->ipc->ops->handle_request(chan->ipc);
imx_dsp_ring_doorbell(chan->ipc, 1);
}
}
struct mbox_chan *imx_dsp_request_channel(struct imx_dsp_ipc *dsp_ipc, int idx)
{
struct imx_dsp_chan *dsp_chan;
if (idx >= DSP_MU_CHAN_NUM)
return ERR_PTR(-EINVAL);
dsp_chan = &dsp_ipc->chans[idx];
dsp_chan->ch = mbox_request_channel_byname(&dsp_chan->cl, dsp_chan->name);
return dsp_chan->ch;
}
EXPORT_SYMBOL(imx_dsp_request_channel);
void imx_dsp_free_channel(struct imx_dsp_ipc *dsp_ipc, int idx)
{
struct imx_dsp_chan *dsp_chan;
if (idx >= DSP_MU_CHAN_NUM)
return;
dsp_chan = &dsp_ipc->chans[idx];
mbox_free_channel(dsp_chan->ch);
}
EXPORT_SYMBOL(imx_dsp_free_channel);
static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
{
struct device *dev = dsp_ipc->dev;
struct imx_dsp_chan *dsp_chan;
struct mbox_client *cl;
char *chan_name;
int ret;
int i, j;
for (i = 0; i < DSP_MU_CHAN_NUM; i++) {
if (i < 2)
chan_name = kasprintf(GFP_KERNEL, "txdb%d", i);
else
chan_name = kasprintf(GFP_KERNEL, "rxdb%d", i - 2);
if (!chan_name)
return -ENOMEM;
dsp_chan = &dsp_ipc->chans[i];
dsp_chan->name = chan_name;
cl = &dsp_chan->cl;
cl->dev = dev;
cl->tx_block = false;
cl->knows_txdone = true;
cl->rx_callback = imx_dsp_handle_rx;
dsp_chan->ipc = dsp_ipc;
dsp_chan->idx = i % 2;
dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
if (IS_ERR(dsp_chan->ch)) {
ret = PTR_ERR(dsp_chan->ch);
if (ret != -EPROBE_DEFER)
dev_err(dev, "Failed to request mbox chan %s ret %d\n",
chan_name, ret);
kfree(dsp_chan->name);
goto out;
}
dev_dbg(dev, "request mbox chan %s\n", chan_name);
}
return 0;
out:
for (j = 0; j < i; j++) {
dsp_chan = &dsp_ipc->chans[j];
mbox_free_channel(dsp_chan->ch);
kfree(dsp_chan->name);
}
return ret;
}
static int imx_dsp_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct imx_dsp_ipc *dsp_ipc;
int ret;
device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
dsp_ipc = devm_kzalloc(dev, sizeof(*dsp_ipc), GFP_KERNEL);
if (!dsp_ipc)
return -ENOMEM;
dsp_ipc->dev = dev;
dev_set_drvdata(dev, dsp_ipc);
ret = imx_dsp_setup_channels(dsp_ipc);
if (ret < 0)
return ret;
dev_info(dev, "NXP i.MX DSP IPC initialized\n");
return 0;
}
static int imx_dsp_remove(struct platform_device *pdev)
{
struct imx_dsp_chan *dsp_chan;
struct imx_dsp_ipc *dsp_ipc;
int i;
dsp_ipc = dev_get_drvdata(&pdev->dev);
for (i = 0; i < DSP_MU_CHAN_NUM; i++) {
dsp_chan = &dsp_ipc->chans[i];
mbox_free_channel(dsp_chan->ch);
kfree(dsp_chan->name);
}
return 0;
}
static struct platform_driver imx_dsp_driver = {
.driver = {
.name = "imx-dsp",
},
.probe = imx_dsp_probe,
.remove = imx_dsp_remove,
};
builtin_platform_driver(imx_dsp_driver);
MODULE_AUTHOR("Daniel Baluta <daniel.baluta@nxp.com>");
MODULE_DESCRIPTION("IMX DSP IPC protocol driver");
MODULE_LICENSE("GPL v2");