mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-29 13:53:33 +00:00
Code Issues Releases Wiki Activity

greybus: manifest: fix bundle descriptor parse

Browse source 
The descriptor list is walked in two points, in the bundle parsing and
cport parsing, this can make the next descriptor pointer in bundle to be
already removed by the cport remove descriptor and become invalid.

So, just get the next bundle until there no more left.

Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Rui Miguel Silva 2015-11-16 19:23:25 +00:00 committed by Greg Kroah-Hartman
parent 80ee842825
commit 5c864e775d
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
drivers/staging/greybus/manifest.c
View file

@ -60,6 +60,18 @@ static void release_manifest_descriptors(struct gb_interface *intf)
release_manifest_descriptor(descriptor);
}
static struct manifest_desc *get_next_bundle_desc(struct gb_interface *intf)
{
struct manifest_desc *descriptor;
struct manifest_desc *next;
list_for_each_entry_safe(descriptor, next, &intf->manifest_descs, links)
if (descriptor->type == GREYBUS_TYPE_BUNDLE)
return descriptor;
return NULL;
}
/*
* Validate the given descriptor. Its reported size must fit within
* the number of bytes remaining, and it must have a recognized
@ -282,18 +294,14 @@ static u32 gb_manifest_parse_cports(struct gb_bundle *bundle)
static u32 gb_manifest_parse_bundles(struct gb_interface *intf)
{
struct manifest_desc *desc;
struct manifest_desc *next;
struct gb_bundle *bundle;
struct gb_bundle *bundle_next;
u32 count = 0;
u8 bundle_id;
list_for_each_entry_safe(desc, next, &intf->manifest_descs, links) {
while ((desc = get_next_bundle_desc(intf))) {
struct greybus_descriptor_bundle *desc_bundle;
if (desc->type != GREYBUS_TYPE_BUNDLE)
continue;
/* Found one. Set up its bundle structure*/
desc_bundle = desc->data;
bundle_id = desc_bundle->id;