mhi: core: Fix out of bound channel id handling
If transfer completion event ring element includes invalid
channel id, driver continues in a while loop without
incrementing local event ring read pointer. This results
into infinite loop. Hence recycle the current element and
move to next event ring element.
Change-Id: I01c5f6aaa596fccc1472f5988f431c77ad13820b
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
diff --git a/drivers/bus/mhi/core/mhi_main.c b/drivers/bus/mhi/core/mhi_main.c
index 1b81eb8..0b5efaa 100644
--- a/drivers/bus/mhi/core/mhi_main.c
+++ b/drivers/bus/mhi/core/mhi_main.c
@@ -1287,7 +1287,7 @@
chan = MHI_TRE_GET_EV_CHID(local_rp);
if (chan >= mhi_cntrl->max_chan) {
MHI_ERR("invalid channel id %u\n", chan);
- continue;
+ goto next_er_element;
}
mhi_chan = &mhi_cntrl->mhi_chan[chan];
@@ -1299,6 +1299,7 @@
event_quota--;
}
+next_er_element:
mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);
local_rp = ev_ring->rp;
dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);