diff options
| author | Ley Foon Tan | 2019-04-24 13:21:47 +0800 |
|---|---|---|
| committer | Marek Vasut | 2019-04-25 00:00:49 +0200 |
| commit | bf068c7643f23c3f0936e3d1d292cc537acaf3bb (patch) | |
| tree | f010dc32ca2b5499bbac29d32ddb4b856c4e9400 | |
| parent | 4aab2329b282956b3a8a22de7bd30116d1c8df20 (diff) | |
arm: socfpga: mailbox: Fix off-by-one error on command length checking
A mailbox command contains 1-u32 header + arguments. The "len" variable
only contains the length of the arguments, but not the 1-u32 header.
Include the length of header when checking the ring buffer space to
prevent off-by-one error.
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Signed-off-by: Chee Hong Ang <chee.hong.ang@intel.com>
| -rw-r--r-- | arch/arm/mach-socfpga/mailbox_s10.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c index 3c332239361..4498ab55dfa 100644 --- a/arch/arm/mach-socfpga/mailbox_s10.c +++ b/arch/arm/mach-socfpga/mailbox_s10.c @@ -55,11 +55,11 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len, cout = MBOX_READL(MBOX_COUT) % MBOX_CMD_BUFFER_SIZE; /* if command buffer is full or not enough free space - * to fit the data + * to fit the data. Note, len is in u32 unit. */ if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) % - MBOX_CMD_BUFFER_SIZE) < len) + MBOX_CMD_BUFFER_SIZE) < (len + 1)) return -ENOMEM; /* write header to circular buffer */ |