Commit 45a832f9 authored by Jarkko Nikula's avatar Jarkko Nikula Committed by Alexandre Belloni

i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler

Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
Signed-off-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.intel.comSigned-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
parent 0676bfeb
...@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask) ...@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)
unsigned int i; unsigned int i;
bool handled = false; bool handled = false;
for (i = 0; mask && i < 8; i++) { for (i = 0; mask && i < rings->total; i++) {
struct hci_rh_data *rh; struct hci_rh_data *rh;
u32 status; u32 status;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment