Merge "mhi: core: Add range check for channel id received in event ring" (d484105d) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/bus/mhi/core/mhi_main.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	/* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.		/* Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
	*		*
	* This program is free software; you can redistribute it and/or modify		* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License version 2 and		* it under the terms of the GNU General Public License version 2 and
	@@ -1111,6 +1111,10 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl,
	complete(&mhi_tsync->completion);		complete(&mhi_tsync->completion);
	} else {		} else {
	chan = MHI_TRE_GET_CMD_CHID(cmd_pkt);		chan = MHI_TRE_GET_CMD_CHID(cmd_pkt);
			if (chan >= mhi_cntrl->max_chan) {
			MHI_ERR("invalid channel id %u\n", chan);
			break;
			}
	mhi_chan = &mhi_cntrl->mhi_chan[chan];		mhi_chan = &mhi_cntrl->mhi_chan[chan];
	write_lock_bh(&mhi_chan->lock);		write_lock_bh(&mhi_chan->lock);
	mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre);		mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre);