diff options
| author | Jarkko Nikula <jarkko.nikula@linux.intel.com> | 2023-09-21 08:56:56 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-11-28 20:19:46 +0300 |
| commit | 4c86cb2321bd9c72d3b945ce7f747961beda8e65 (patch) | |
| tree | a51291afe8ece09a9fc86e3bccdc2cfbe2bb8976 /drivers/i3c | |
| parent | 35663b6b49a30d2303ccef33bdd10cb1fcf4a101 (diff) | |
| download | linux-4c86cb2321bd9c72d3b945ce7f747961beda8e65.tar.xz | |
i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]
Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/i3c')
| -rw-r--r-- | drivers/i3c/master/mipi-i3c-hci/dma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c index 2990ac9eaade..71b5dbe45c45 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask) unsigned int i; bool handled = false; - for (i = 0; mask && i < 8; i++) { + for (i = 0; mask && i < rings->total; i++) { struct hci_rh_data *rh; u32 status; |