[PW_SID:1071502] Bluetooth: btintel_pcie: validate completion ring indices#3393
[PW_SID:1071502] Bluetooth: btintel_pcie: validate completion ring indices#3393BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
The MSI-X RX and TX completion handlers trust the shared ring indices read from data->ia.cr_tia[] and data->ia.cr_hia[] before using cr_tia as an index into the fixed urbd ring arrays. If the device reports a stale or malformed completion index, the driver can step past rxq->urbd1s[] or txq->urbd0s[] before it gets a chance to recover. Validate both completion ring indices against the queue depth before walking the descriptor arrays. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
9 times, most recently
from
c6e7062 to
0e0806d
Compare
github-actions
bot
force-pushed
the
workflow
branch
5 times, most recently
from
f07ea67 to
9a108c6
Compare
3 participants
The MSI-X RX and TX completion handlers trust the shared ring indices
read from data->ia.cr_tia[] and data->ia.cr_hia[] before using cr_tia as
an index into the fixed urbd ring arrays. If the device reports a stale
or malformed completion index, the driver can step past rxq->urbd1s[] or
txq->urbd0s[] before it gets a chance to recover.
Validate both completion ring indices against the queue depth before
walking the descriptor arrays.
Signed-off-by: Pengpeng Hou pengpeng@iscas.ac.cn
drivers/bluetooth/btintel_pcie.c | 13 +++++++++++++
1 file changed, 13 insertions(+)