Merge "mhi: core: Add range check for channel id received in event ring" (aed9c486) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/bus/mhi/core/mhi_internal.h

+3 −16

Original line number	Diff line number	Diff line
		/* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -914,22 +914,9 @@ irqreturn_t mhi_intvec_threaded_handlr(int irq_number, void *dev);
		irqreturn_t mhi_intvec_handlr(int irq_number, void *dev);
		void mhi_ev_task(unsigned long data);

		#ifdef CONFIG_MHI_DEBUG

		#define MHI_ASSERT(cond, msg) do { \
		#define MHI_ASSERT(cond, fmt, ...) do { \
		if (cond) \
		panic(msg); \
		panic(fmt); \
		} while (0)

		#else

		#define MHI_ASSERT(cond, msg) do { \
		if (cond) { \
		MHI_ERR(msg); \
		WARN_ON(cond); \
		} \
		} while (0)

		#endif

		#endif /* _MHI_INT_H */

+4 −0

Original line number	Diff line number	Diff line
		@@ -1187,6 +1187,10 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl,
		break;
		default:
		chan = MHI_TRE_GET_CMD_CHID(cmd_pkt);
		if (chan >= mhi_cntrl->max_chan) {
		MHI_ERR("invalid channel id %u\n", chan);
		break;
		}
		mhi_chan = &mhi_cntrl->mhi_chan[chan];
		write_lock_bh(&mhi_chan->lock);
		mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre);