On 4/24/19 7:21 AM, Ley Foon Tan wrote: > A mailbox command contains 1-u32 header + arguments. The "len" variable > only contains the length of the arguments, but not the 1-u32 header. > Include the length of header when checking the ring buffer space to > prevent off-by-one error. > > Signed-off-by: Ley Foon Tan <ley.foon....@intel.com> > Signed-off-by: Chee Hong Ang <chee.hong....@intel.com> > --- > v3->v4: > - Change DWORD to u32 in commit message > - Add note len is in u32 unit in code > > v2->v3: > - Update commit description. > --- > arch/arm/mach-socfpga/mailbox_s10.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/arm/mach-socfpga/mailbox_s10.c > b/arch/arm/mach-socfpga/mailbox_s10.c > index 3c33223936..4498ab55df 100644 > --- a/arch/arm/mach-socfpga/mailbox_s10.c > +++ b/arch/arm/mach-socfpga/mailbox_s10.c > @@ -55,11 +55,11 @@ static __always_inline int > mbox_fill_cmd_circular_buff(u32 header, u32 len, > cout = MBOX_READL(MBOX_COUT) % MBOX_CMD_BUFFER_SIZE; > > /* if command buffer is full or not enough free space > - * to fit the data > + * to fit the data. Note, len is in u32 unit. > */ > if (((cin + 1) % MBOX_CMD_BUFFER_SIZE) == cout || > ((MBOX_CMD_BUFFER_SIZE - cin + cout - 1) % > - MBOX_CMD_BUFFER_SIZE) < len) > + MBOX_CMD_BUFFER_SIZE) < (len + 1)) > return -ENOMEM; > > /* write header to circular buffer */ >
Applied, thanks. -- Best regards, Marek Vasut _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot
