Merge "mhi: core: Add range check for channel id received in event ring" (9d5f2378) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/bus/mhi/core/mhi_main.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -1374,6 +1374,10 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl,
		local_rp->ptr, local_rp->dword[0], local_rp->dword[1]);

		chan = MHI_TRE_GET_EV_CHID(local_rp);
		if (chan >= mhi_cntrl->max_chan) {
		MHI_ERR("invalid channel id %u\n", chan);
		continue;
		}
		mhi_chan = &mhi_cntrl->mhi_chan[chan];

		if (likely(type == MHI_PKT_TYPE_TX_EVENT)) {