bus: mhi: core: Validate channel ID when processing command completions
stable inclusion from stable-5.10.54 commit 3efec3b4b16fc7af25676a94230a8ab2a3bb867c bugzilla: 175586 https://gitee.com/openeuler/kernel/issues/I4DVDU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3efec3b4b16fc7af25676a94230a8ab2a3bb867c -------------------------------- commit 546362a9 upstream. MHI reads the channel ID from the event ring element sent by the device which can be any value between 0 and 255. In order to prevent any out of bound accesses, add a check against the maximum number of channels supported by the controller and those channels not configured yet so as to skip processing of that event ring element. Link: https://lore.kernel.org/r/1624558141-11045-1-git-send-email-bbhatt@codeaurora.org Fixes: 1d3173a3 ("bus: mhi: core: Add support for processing events from client device") Cc: stable@vger.kernel.org #5.10 Reviewed-by: NHemant Kumar <hemantk@codeaurora.org> Reviewed-by: NManivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: NJeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: NBhaumik Bhatt <bbhatt@codeaurora.org> Signed-off-by: NManivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://lore.kernel.org/r/20210716075106.49938-3-manivannan.sadhasivam@linaro.orgSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: NChen Jun <chenjun102@huawei.com> Acked-by: NWeilong Chen <chenweilong@huawei.com> Signed-off-by: NChen Jun <chenjun102@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Showing
想要评论请 注册 或 登录