Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa96a48d authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "mhi: core: Add range check for channel id received in event ring"

parents 654a3d37 e53d1da2

drivers/bus/mhi/core/mhi_internal.h

+1 −14
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

/* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. */

/* Copyright (c) 2018-2020, The Linux Foundation. All rights reserved. */



#ifndef _MHI_INT_H

#define _MHI_INT_H
@@ -946,22 +946,9 @@ irqreturn_t mhi_intvec_threaded_handlr(int irq_number, void *dev); 
irqreturn_t mhi_intvec_handlr(int irq_number, void *dev);

void mhi_ev_task(unsigned long data);



#ifdef CONFIG_MHI_DEBUG



#define MHI_ASSERT(cond, fmt, ...) do { \

	if (cond) \

		panic(fmt); \

} while (0)



#else



#define MHI_ASSERT(cond, fmt, ...) do { \

	if (cond) { \

		MHI_ERR(fmt); \

		WARN_ON(cond); \

	} \

} while (0)



#endif



#endif /* _MHI_INT_H */

drivers/bus/mhi/core/mhi_main.c

+6 −1
Original line number Diff line number Diff line
@@ -1048,7 +1048,8 @@ static int parse_xfer_event(struct mhi_controller *mhi_cntrl, 
				mhi_cntrl->unmap_single(mhi_cntrl, buf_info);



			result.buf_addr = buf_info->cb_buf;

			result.bytes_xferd = xfer_len;

			result.bytes_xferd = min_t(u16, xfer_len,

					buf_info->len);

			mhi_del_ring_element(mhi_cntrl, buf_ring);

			mhi_del_ring_element(mhi_cntrl, tre_ring);

			local_rp = tre_ring->rp;
@@ -1223,6 +1224,10 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, 
		break;

	default:

		chan = MHI_TRE_GET_CMD_CHID(cmd_pkt);

		if (chan >= mhi_cntrl->max_chan) {

			MHI_ERR("invalid channel id %u\n", chan);

			break;

		}

		mhi_chan = &mhi_cntrl->mhi_chan[chan];

		write_lock_bh(&mhi_chan->lock);

		mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre);