Merge "mhi: core: Fix out of bound channel id handling" (aebb4fd3) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/bus/mhi/core/mhi_main.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1322,7 +1322,7 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl,
		chan = MHI_TRE_GET_EV_CHID(local_rp);
		if (chan >= mhi_cntrl->max_chan) {
		MHI_ERR("invalid channel id %u\n", chan);
		continue;
		goto next_er_element;
		}
		mhi_chan = &mhi_cntrl->mhi_chan[chan];

		@@ -1334,6 +1334,7 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl,
		event_quota--;
		}

		next_er_element:
		mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);
		local_rp = ev_ring->rp;
		dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);