[U-Boot] [PATCH v3] arm: socfpga: mailbox: Fix off-by-one error on command length checking
Ley Foon Tan
ley.foon.tan at intel.com
Fri Apr 19 06:17:41 UTC 2019
A mailbox command contains 1-DWORD header + arguments. The "len" variable
only contains the length of the arguments, but not the 1-DWORD header.
Include the length of header when checking the ring buffer space to
prevent off-by-one error.
Signed-off-by: Ley Foon Tan <ley.foon.tan at intel.com>
Signed-off-by: Chee Hong Ang <chee.hong.ang at intel.com>
---
v2->v3:
- Update commit description.
---
arch/arm/mach-socfpga/mailbox_s10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-socfpga/mailbox_s10.c b/arch/arm/mach-socfpga/mailbox_s10.c
index 3c33223936..8363c93e90 100644
--- a/arch/arm/mach-socfpga/mailbox_s10.c
+++ b/arch/arm/mach-socfpga/mailbox_s10.c
@@ -59,7 +59,7 @@ static __always_inline int mbox_fill_cmd_circular_buff(u32 header, u32 len,
*/
if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout ||
((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) %
- MBOX_CMD_BUFFER_SIZE) < len)
+ MBOX_CMD_BUFFER_SIZE) < (len + 1))
return -ENOMEM;
/* write header to circular buffer */
--
2.19.0
More information about the U-Boot
mailing list