[PATCH] remoteproc: Fix wrong rvring index computation

[PATCH] remoteproc: Fix wrong rvring index computation

[Clement Leger]

Index of rvring is computed using pointer arithmetic. However, since
rvring->rvdev->vring is the base of the vring array, computation
of rvring idx should be reversed. It previously lead to writing at negative
indices in the resource table.

Signed-off-by: Clement Leger <cleger@kalray.eu>
---
 drivers/remoteproc/remoteproc_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 3c5fbbbfb0f1..ab7443874635 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -400,7 +400,7 @@ rproc_parse_vring(struct rproc_vdev *rvdev, struct fw_rsc_vdev *rsc, int i)
 void rproc_free_vring(struct rproc_vring *rvring)
 {
 	struct rproc *rproc = rvring->rvdev->rproc;
-	int idx = rvring->rvdev->vring - rvring;
+	int idx = rvring - rvring->rvdev->vring;
 	struct fw_rsc_vdev *rsc;
 
 	idr_remove(&rproc->notifyids, rvring->notifyid);
-- 
2.15.0.276.g89ea799

Re: [PATCH] remoteproc: Fix wrong rvring index computation

[Doug Anderson]

Hi,

On Fri,  4 Oct 2019 Clement Leger <cleger@kalray.eu> wrote:
>
> Index of rvring is computed using pointer arithmetic. However, since
> rvring->rvdev->vring is the base of the vring array, computation
> of rvring idx should be reversed. It previously lead to writing at negative
> indices in the resource table.
>
> Signed-off-by: Clement Leger <cleger@kalray.eu>
> ---
>  drivers/remoteproc/remoteproc_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Randomly stumbled upon this in a list of patches.  This patch landed
in mainline as:

00a0eec59ddb remoteproc: Fix wrong rvring index computation

Should it be queued up for stable?  I'm guessing:

Fixes: c0d631570ad5 ("remoteproc: set vring addresses in resource table")

-Doug

Re: [PATCH] remoteproc: Fix wrong rvring index computation

[Greg KH]

On Wed, Apr 29, 2020 at 04:26:41PM -0700, Doug Anderson wrote:
> Hi,
> 
> On Fri,  4 Oct 2019 Clement Leger <cleger@kalray.eu> wrote:
> >
> > Index of rvring is computed using pointer arithmetic. However, since
> > rvring->rvdev->vring is the base of the vring array, computation
> > of rvring idx should be reversed. It previously lead to writing at negative
> > indices in the resource table.
> >
> > Signed-off-by: Clement Leger <cleger@kalray.eu>
> > ---
> >  drivers/remoteproc/remoteproc_core.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Randomly stumbled upon this in a list of patches.  This patch landed
> in mainline as:
> 
> 00a0eec59ddb remoteproc: Fix wrong rvring index computation
> 
> Should it be queued up for stable?  I'm guessing:
> 
> Fixes: c0d631570ad5 ("remoteproc: set vring addresses in resource table")

Thanks, now queued up.

greg k-h