Messages in this thread Patch in this message | | | From | Bhaumik Bhatt <> | Subject | [PATCH v1 2/8] bus: mhi: core: Add range check for channel id received in event ring | Date | Mon, 27 Apr 2020 11:32:16 -0700 |
| |
From: Hemant Kumar <hemantk@codeaurora.org>
MHI data completion handler function reads channel id from event ring element. Value is under the control of MHI devices and can be any value between 0 and 255. In order to prevent out of bound access add a bound check against the max channel supported by controller and skip processing of that event ring element.
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org> --- drivers/bus/mhi/core/main.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c index 23154f1..ba8afa7 100644 --- a/drivers/bus/mhi/core/main.c +++ b/drivers/bus/mhi/core/main.c @@ -827,6 +827,9 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl, enum mhi_pkt_type type = MHI_TRE_GET_EV_TYPE(local_rp); chan = MHI_TRE_GET_EV_CHID(local_rp); + if (WARN_ON(chan >= mhi_cntrl->max_chan)) + continue; + mhi_chan = &mhi_cntrl->mhi_chan[chan]; if (likely(type == MHI_PKT_TYPE_TX_EVENT)) { -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
| |