Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e84d93f authored by Hemant Kumar's avatar Hemant Kumar
Browse files

mhi: core: Fix out of bound channel id handling 



If transfer completion event ring element includes invalid
channel id, driver continues in a while loop without
incrementing local event ring read pointer. This results
into infinite loop. Hence recycle the current element and
move to next event ring element.

Change-Id: I01c5f6aaa596fccc1472f5988f431c77ad13820b
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent 4e1c68c5

drivers/bus/mhi/core/mhi_main.c

+2 −1
Original line number Diff line number Diff line
@@ -1320,7 +1320,7 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl, 
		chan = MHI_TRE_GET_EV_CHID(local_rp);

		if (chan >= mhi_cntrl->max_chan) {

			MHI_ERR("invalid channel id %u\n", chan);

			continue;

			goto next_er_element;

		}

		mhi_chan = &mhi_cntrl->mhi_chan[chan];
@@ -1332,6 +1332,7 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl, 
			event_quota--;

		}



next_er_element:

		mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);

		local_rp = ev_ring->rp;

		dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);