mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
drm: bridge: sii8620: fix possible off-by-one
[ Upstream commit21779cc21c
] The next call to sii8620_burst_get_tx_buf will result in off-by-one When ctx->burst.tx_count + size == ARRAY_SIZE(ctx->burst.tx_buf). The same thing happens in sii8620_burst_get_rx_buf. This patch also change tx_count and tx_buf to rx_count and rx_buf in sii8620_burst_get_rx_buf. It is unreasonable to check tx_buf's size and use rx_buf. Fixes:e19e9c692f
("drm/bridge/sii8620: add support for burst eMSC transmissions") Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Signed-off-by: Robert Foss <robert.foss@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20220518065856.18936-1-hbh25y@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
966a032cd1
commit
87d8b15bf9
1 changed files with 2 additions and 2 deletions
|
@ -628,7 +628,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len)
|
|||
u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count];
|
||||
int size = len + 2;
|
||||
|
||||
if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) {
|
||||
if (ctx->burst.tx_count + size >= ARRAY_SIZE(ctx->burst.tx_buf)) {
|
||||
dev_err(ctx->dev, "TX-BLK buffer exhausted\n");
|
||||
ctx->error = -EINVAL;
|
||||
return NULL;
|
||||
|
@ -645,7 +645,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len)
|
|||
u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count];
|
||||
int size = len + 1;
|
||||
|
||||
if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) {
|
||||
if (ctx->burst.rx_count + size >= ARRAY_SIZE(ctx->burst.rx_buf)) {
|
||||
dev_err(ctx->dev, "RX-BLK buffer exhausted\n");
|
||||
ctx->error = -EINVAL;
|
||||
return NULL;
|
||||
|
|
Loading…
Reference in a new issue