diff options
| author | Enrico Scholz <enrico.scholz@sigma-chemnitz.de> | 2020-07-07 18:01:24 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2020-07-11 06:59:09 +0200 |
| commit | 22d5921bd856e910b72c3af7fdca94e402904367 (patch) | |
| tree | 3b59da748c3c7248492cdefe761113303a0ddb7c /drivers | |
| parent | 8535bfc6fb15d3090e08700c17dfad61464fd9c1 (diff) | |
| download | barebox-22d5921bd856e910b72c3af7fdca94e402904367.tar.gz barebox-22d5921bd856e910b72c3af7fdca94e402904367.tar.xz | |
net:fec: fixed unaligned access and stack corruption
on 64 bit architectures, the 'enum fec_type' might not be aligned and
large enough to hold a pointer. When running barebox without MMU,
this will crash like
| i.MX8MM unique ID: dab4b7491a2c4209
| DABT (current EL) exception (ESR 0x96000061) at 0x00000000fffefeb4
| elr: 00000000ffe14c28 lr : 00000000ffe196e0
| x0 : 0000000000000002 x1 : 00000000fffefeb4
| x2 : 00000000ffe91370 x3 : 00000000bfe1b6e8
| x4 : 0000000000000000 x5 : 0000000011000000
| ...
| Call trace:
| [<ffe14c28>] (dev_get_drvdata+0xc/0x30) from [<ffe1446c>] (device_probe+0x54/0xd0)
| [<ffe1446c>] (device_probe+0x54/0xd0) from [<ffe14530>] (match+0x48/0x58)
| [<ffe14530>] (match+0x48/0x58) from [<ffe14a64>] (register_driver+0xc0/0xd0)
| [<ffe14a64>] (register_driver+0xc0/0xd0) from [<ffe01738>] (start_barebox+0x64/0x90)
Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/fec_imx.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/net/fec_imx.c b/drivers/net/fec_imx.c index 772f930f0d..30ee7841fa 100644 --- a/drivers/net/fec_imx.c +++ b/drivers/net/fec_imx.c @@ -739,14 +739,17 @@ static int fec_probe(struct device_d *dev) void *base; int ret; enum fec_type type; + void const *type_v; int phy_reset; u32 msec = 1, phy_post_delay = 0; u32 reg; - ret = dev_get_drvdata(dev, (const void **)&type); + ret = dev_get_drvdata(dev, &type_v); if (ret) return ret; + type = (uintptr_t)(type_v); + fec = xzalloc(sizeof(*fec)); fec->type = type; fec->dev = dev; |