From b99432af45235a1387b460ba55c918377d31cc7d Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Tue, 14 Jan 2020 17:35:10 -0800 Subject: [PATCH] mhi: core: Add range check for channel id received in event ring The mhi_process_cmd_completion function reads cmd channel id from cmd_pkt using MHI_TRE_GET_CHID, the value is under the control of MHI devices and can be any value between 0 and 255. However the max channel is defined in device tree file and it is usually smaller than 255. This can cause out of bound access to the channel array. Fix this by checking the channel id received in cmd ring against the max channel allowed on target. Change-Id: Ib6faf67c7eae67186b3a44e6b1612deff6bf05fa Signed-off-by: Hemant Kumar --- drivers/bus/mhi/core/mhi_main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/bus/mhi/core/mhi_main.c b/drivers/bus/mhi/core/mhi_main.c index cd792cff0a4a..ee0b38aecf43 100644 --- a/drivers/bus/mhi/core/mhi_main.c +++ b/drivers/bus/mhi/core/mhi_main.c @@ -1160,6 +1160,10 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, complete(&mhi_tsync->completion); } else { chan = MHI_TRE_GET_CMD_CHID(cmd_pkt); + if (chan >= mhi_cntrl->max_chan) { + MHI_ERR("invalid channel id %u\n", chan); + goto del_ring_el; + } mhi_chan = &mhi_cntrl->mhi_chan[chan]; write_lock_bh(&mhi_chan->lock); mhi_chan->ccs = MHI_TRE_GET_EV_CODE(tre); @@ -1167,6 +1171,7 @@ static void mhi_process_cmd_completion(struct mhi_controller *mhi_cntrl, write_unlock_bh(&mhi_chan->lock); } +del_ring_el: mhi_del_ring_element(mhi_cntrl, mhi_ring); }