Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 67c5c611 authored by Nitesh Gupta's avatar Nitesh Gupta
Browse files

msm: mhi_dev: Increase size of ipa_clnt_hndl array 



ipa_clnt_hndl array supports only 4 channels. Few targets can
support more MHI HW channels and can cause out of bound access
for higher MHI channels.

Increase ipa_clnt_hndl array size to accommodate the maximum
number of supported MHI HW channels.

Change-Id: Ifb4b17c40a7ac690b9a7fd864b7eb0ade2e5de43
Signed-off-by: default avatarNitesh Gupta <nitegupt@codeaurora.org>
parent e9c5e370

drivers/platform/msm/mhi_dev/mhi.c

+10 −0
Original line number Diff line number Diff line
@@ -837,6 +837,11 @@ static int mhi_hwc_chcmd(struct mhi_dev *mhi, uint chid, 
	switch (type) {

	case MHI_DEV_RING_EL_RESET:

	case MHI_DEV_RING_EL_STOP:

		if ((chid-HW_CHANNEL_BASE) > NUM_HW_CHANNELS) {

			pr_err("Invalid Channel ID = 0x%X\n", chid);

			return -EINVAL;

		}



		rc = ipa_mhi_disconnect_pipe(

			mhi->ipa_clnt_hndl[chid-HW_CHANNEL_BASE]);

		if (rc)
@@ -868,6 +873,11 @@ static int mhi_hwc_chcmd(struct mhi_dev *mhi, uint chid, 
			return -EINVAL;

		}



		if ((chid-HW_CHANNEL_BASE) > NUM_HW_CHANNELS) {

			pr_err("Invalid Channel = 0x%X\n", chid);

			return -EINVAL;

		}



		rc = ipa_mhi_connect_pipe(&connect_params,

			&mhi->ipa_clnt_hndl[chid-HW_CHANNEL_BASE]);

		if (rc)

drivers/platform/msm/mhi_dev/mhi.h

+2 −1
Original line number Diff line number Diff line
@@ -271,6 +271,7 @@ struct mhi_config { 


#define NUM_CHANNELS			128

#define HW_CHANNEL_BASE			100

#define NUM_HW_CHANNELS			15

#define HW_CHANNEL_END			107

#define MHI_ENV_VALUE			2

#define MHI_MASK_ROWS_CH_EV_DB		4
@@ -537,7 +538,7 @@ struct mhi_dev { 
	uint32_t			ch_ring_start;



	/* IPA Handles */

	u32				ipa_clnt_hndl[4];

	u32				ipa_clnt_hndl[NUM_HW_CHANNELS];

	struct workqueue_struct		*ring_init_wq;

	struct work_struct		ring_init_cb_work;

	struct work_struct		re_init;