| Message ID | 1554975462-25407-2-git-send-email-ley.foon.tan@intel.com |
|---|---|
| State | Superseded |
| Delegated to: | Marek Vasut |
| Headers | show |
| Series | [U-Boot,v2] arm: socfpga: mailbox: Fix off-by-one error on command length checking | expand |
On Thu, Apr 11, 2019 at 5:37 PM Ley Foon Tan <ley.foon.tan@intel.com> wrote: > > A mailbox command contains of header + arguments. > But, "len" is only including length of arguments, off-by-one for > length of header in checking. > Includes length of header (1) when checking the space size. > > Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com> > Signed-off-by: Chee Hong Ang <chee.hong.ang@intel.com> > --- > arch/arm/mach-socfpga/mailbox_s10.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c > index 3c33223936..8363c93e90 100644 > --- a/arch/arm/mach-socfpga/mailbox_s10.c > +++ b/arch/arm/mach-socfpga/mailbox_s10.c > @@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, > */ > if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || > ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) % > - MBOX_CMD_BUFFER_SIZE) < len) > + MBOX_CMD_BUFFER_SIZE) < (len + 1)) > return -ENOMEM; > > /* write header to circular buffer */ Hi Marek Are you okay with the new commit message? Thanks. Regards Ley Foon
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 3c33223936..8363c93e90 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, */ if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) % - MBOX_CMD_BUFFER_SIZE) < len) + MBOX_CMD_BUFFER_SIZE) < (len + 1)) return -ENOMEM; /* write header to circular buffer */