[PATCH 2/3] net: fec: Bail out if DMA address is larger than 32-bits

[Andrey Smirnov <andrew.smirnov@gmail.com>]

On 64-bit SoCs it becomes possible to end up with a DMA buffer
allocated in the region of memory inaccessible to FEC
controller. Change the code to bail out if that happens to avoid
silent failures that'd result otherwise.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
 drivers/net/fec_imx.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/fec_imx.c b/drivers/net/fec_imx.c
index 98711baa7..a61fd8294 100644
--- a/drivers/net/fec_imx.c
+++ b/drivers/net/fec_imx.c
@@ -484,6 +484,9 @@ static int fec_send(struct eth_device *dev, void *eth_data, int data_length)
 	if (dma_mapping_error(fec->dev, dma))
 		return -EIO;
 
+	if (dma > U32_MAX)
+		return -EFAULT;
+
 	writel((uint32_t)(dma), &fec->tbd_base[fec->tbd_index].data_pointer);
 
 	/*
@@ -612,7 +615,12 @@ static int fec_alloc_receive_packets(struct fec_priv *fec, int count, int size)
 		return -ENOMEM;
 
 	for (i = 0; i < count; i++) {
-		writel(virt_to_phys(p), &fec->rbd_base[i].data_pointer);
+		unsigned long addr = virt_to_phys(p);
+
+		if (addr > U32_MAX)
+			return -EFAULT;
+
+		writel(addr, &fec->rbd_base[i].data_pointer);
 		p += size;
 	}
 
-- 
2.17.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox