Re: [PATCH] bus: mhi: host: Detect events pointing to unexpected TREs

[Jeff Hugo <jeff.hugo@oss.qualcomm.com>]

On 5/21/2025 10:31 AM, Youssef Samir wrote:
> When a remote device sends a completion event to the host, it contains a
> pointer to the consumed TRE. The host uses this pointer to process all of
> the TREs between it and the host's local copy of the ring's read pointer.
> This works when processing completion for chained transactions, but can
> lead to nasty results if the device sends an event for a single-element
> transaction with a read pointer that is multiple elements ahead of the
> host's read pointer.
> 
> For instance, if the host accesses an event ring while the device is
> updating it, the pointer inside of the event might still point to an old
> TRE. If the host uses the channel's xfer_cb() to directly free the buffer
> pointed to by the TRE, the buffer will be double-freed.
> 
> Validate the pointer inside an event before processing it.
> 
> Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device")
> Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>

Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>