[U-Boot] [PATCH] arm: socfpga: Fix mailbox command length checking
A mailbox command including header + arguments. But, "len" only including length of arguments, it missed the length of header in checking. Includes length of header (1) when checking the space size.
Signed-off-by: Ley Foon Tan ley.foon.tan@intel.com Signed-off-by: Chee Hong Ang chee.hong.ang@intel.com --- arch/arm/mach-socfpga/mailbox_s10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 3c33223936..8363c93e90 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, */ if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) % - MBOX_CMD_BUFFER_SIZE) < len) + MBOX_CMD_BUFFER_SIZE) < (len + 1)) return -ENOMEM;
/* write header to circular buffer */
A mailbox command contains of header + arguments. But, "len" is only including length of arguments, off-by-one for length of header in checking. Includes length of header (1) when checking the space size.
Signed-off-by: Ley Foon Tan ley.foon.tan@intel.com Signed-off-by: Chee Hong Ang chee.hong.ang@intel.com --- arch/arm/mach-socfpga/mailbox_s10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 3c33223936..8363c93e90 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, */ if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) % - MBOX_CMD_BUFFER_SIZE) < len) + MBOX_CMD_BUFFER_SIZE) < (len + 1)) return -ENOMEM;
/* write header to circular buffer */
On Thu, Apr 11, 2019 at 5:37 PM Ley Foon Tan ley.foon.tan@intel.com wrote:
A mailbox command contains of header + arguments. But, "len" is only including length of arguments, off-by-one for length of header in checking. Includes length of header (1) when checking the space size.
Signed-off-by: Ley Foon Tan ley.foon.tan@intel.com Signed-off-by: Chee Hong Ang chee.hong.ang@intel.com
arch/arm/mach-socfpga/mailbox_s10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 3c33223936..8363c93e90 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, */ if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) %
MBOX_CMD_BUFFER_SIZE) < len)
MBOX_CMD_BUFFER_SIZE) < (len + 1)) return -ENOMEM; /* write header to circular buffer */
Hi Marek
Are you okay with the new commit message? Thanks.
Regards Ley Foon
On Thu, Apr 11, 2019 at 5:37 PM Ley Foon Tan ley.foon.tan@intel.com wrote:
A mailbox command including header + arguments. But, "len" only including length of arguments, it missed the length of header in checking. Includes length of header (1) when checking the space size.
Signed-off-by: Ley Foon Tan ley.foon.tan@intel.com Signed-off-by: Chee Hong Ang chee.hong.ang@intel.com
arch/arm/mach-socfpga/mailbox_s10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 3c33223936..8363c93e90 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, */ if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) %
MBOX_CMD_BUFFER_SIZE) < len)
MBOX_CMD_BUFFER_SIZE) < (len + 1)) return -ENOMEM; /* write header to circular buffer */-- 2.19.0
Please ignore this, Resend accidentally.
Ley Foon
participants (2)
-
Ley Foon Tan -
Ley Foon Tan