Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c864e77 authored by Rui Miguel Silva's avatar Rui Miguel Silva Committed by Greg Kroah-Hartman
Browse files

greybus: manifest: fix bundle descriptor parse 



The descriptor list is walked in two points, in the bundle parsing and
cport parsing, this can make the next descriptor pointer in bundle to be
already removed by the cport remove descriptor and become invalid.

So, just get the next bundle until there no more left.

Signed-off-by: default avatarRui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent 80ee8428

drivers/staging/greybus/manifest.c

+13 −5
Original line number Diff line number Diff line
@@ -60,6 +60,18 @@ static void release_manifest_descriptors(struct gb_interface *intf) 
		release_manifest_descriptor(descriptor);

}



static struct manifest_desc *get_next_bundle_desc(struct gb_interface *intf)

{

	struct manifest_desc *descriptor;

	struct manifest_desc *next;



	list_for_each_entry_safe(descriptor, next, &intf->manifest_descs, links)

		if (descriptor->type == GREYBUS_TYPE_BUNDLE)

			return descriptor;



	return NULL;

}



/*

 * Validate the given descriptor.  Its reported size must fit within

 * the number of bytes remaining, and it must have a recognized
@@ -282,18 +294,14 @@ static u32 gb_manifest_parse_cports(struct gb_bundle *bundle) 
static u32 gb_manifest_parse_bundles(struct gb_interface *intf)

{

	struct manifest_desc *desc;

	struct manifest_desc *next;

	struct gb_bundle *bundle;

	struct gb_bundle *bundle_next;

	u32 count = 0;

	u8 bundle_id;



	list_for_each_entry_safe(desc, next, &intf->manifest_descs, links) {

	while ((desc = get_next_bundle_desc(intf))) {

		struct greybus_descriptor_bundle *desc_bundle;



		if (desc->type != GREYBUS_TYPE_BUNDLE)

			continue;



		/* Found one.  Set up its bundle structure*/

		desc_bundle = desc->data;

		bundle_id = desc_bundle->id;