]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
authorJarkko Nikula <jarkko.nikula@linux.intel.com>
Thu, 21 Sep 2023 05:56:56 +0000 (08:56 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 28 Nov 2023 16:56:19 +0000 (16:56 +0000)
commitd23ad76f240c0f597b7a9eb79905d246f27d40df
tree4c36a2f54f8c890a7526bc83186a119818b922e5
parente6fbad3cc88098ec341f50b60fa46b98f0bf8652
i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler

[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]

Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.

Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/i3c/master/mipi-i3c-hci/dma.c