iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler

Browse Source 
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]

Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.

Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jarkko Nikula 2023-09-21 08:56:56 +03:00 committed by Greg Kroah-Hartman
parent 35663b6b49
commit 4c86cb2321
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/i3c/master/mipi-i3c-hci/dma.c
View File

@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)
unsigned int i;
bool handled = false;
for (i = 0; mask && i < 8; i++) {
for (i = 0; mask && i < rings->total; i++) {
struct hci_rh_data *rh;
u32 status;