| .. | .. |
|---|
| 58 | 58 | void shmem_fetch_response(struct scmi_shared_mem __iomem *shmem, |
|---|
| 59 | 59 | struct scmi_xfer *xfer) |
|---|
| 60 | 60 | { |
|---|
| 61 | + size_t len = ioread32(&shmem->length); |
|---|
| 62 | + |
|---|
| 61 | 63 | xfer->hdr.status = ioread32(shmem->msg_payload); |
|---|
| 62 | 64 | /* Skip the length of header and status in shmem area i.e 8 bytes */ |
|---|
| 63 | | - xfer->rx.len = min_t(size_t, xfer->rx.len, |
|---|
| 64 | | - ioread32(&shmem->length) - 8); |
|---|
| 65 | + xfer->rx.len = min_t(size_t, xfer->rx.len, len > 8 ? len - 8 : 0); |
|---|
| 65 | 66 | |
|---|
| 66 | 67 | /* Take a copy to the rx buffer.. */ |
|---|
| 67 | 68 | memcpy_fromio(xfer->rx.buf, shmem->msg_payload + 4, xfer->rx.len); |
|---|
| .. | .. |
|---|
| 70 | 71 | void shmem_fetch_notification(struct scmi_shared_mem __iomem *shmem, |
|---|
| 71 | 72 | size_t max_len, struct scmi_xfer *xfer) |
|---|
| 72 | 73 | { |
|---|
| 74 | + size_t len = ioread32(&shmem->length); |
|---|
| 75 | + |
|---|
| 73 | 76 | /* Skip only the length of header in shmem area i.e 4 bytes */ |
|---|
| 74 | | - xfer->rx.len = min_t(size_t, max_len, ioread32(&shmem->length) - 4); |
|---|
| 77 | + xfer->rx.len = min_t(size_t, max_len, len > 4 ? len - 4 : 0); |
|---|
| 75 | 78 | |
|---|
| 76 | 79 | /* Take a copy to the rx buffer.. */ |
|---|
| 77 | 80 | memcpy_fromio(xfer->rx.buf, shmem->msg_payload, xfer->rx.len); |
|---|