A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

mhi: core: Fix out of bound channel id handling

Browse source 
If transfer completion event ring element includes invalid
channel id, driver continues in a while loop without
incrementing local event ring read pointer. This results
into infinite loop. Hence recycle the current element and
move to next event ring element.

Change-Id: I01c5f6aaa596fccc1472f5988f431c77ad13820b
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
This commit is contained in:
Hemant Kumar 2020-04-27 20:18:44 -07:00 • committed by Gerrit - the friendly Code Review server
commit 78b46d3240
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/bus/mhi/core/mhi_main.c
View file

@ -1321,7 +1321,7 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl,
chan = MHI_TRE_GET_EV_CHID(local_rp);
if (chan >= mhi_cntrl->max_chan) {
MHI_ERR("invalid channel id %u\n", chan);
continue;
goto next_er_element;
}
mhi_chan = &mhi_cntrl->mhi_chan[chan];
@ -1333,6 +1333,7 @@ int mhi_process_data_event_ring(struct mhi_controller *mhi_cntrl,
event_quota--;
}
next_er_element:
mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);
local_rp = ev_ring->rp;
dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);