update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/firmware/arm_scmi/shmem.c
..
..
@@ -58,10 +58,11 @@
58
58
 void shmem_fetch_response(struct scmi_shared_mem __iomem *shmem,
59
59
 			  struct scmi_xfer *xfer)
60
60
 {
61
+	size_t len = ioread32(&shmem->length);
62
+
61
63
 	xfer->hdr.status = ioread32(shmem->msg_payload);
62
64
 	/* Skip the length of header and status in shmem area i.e 8 bytes */
63
-	xfer->rx.len = min_t(size_t, xfer->rx.len,
64
-			     ioread32(&shmem->length) - 8);
65
+	xfer->rx.len = min_t(size_t, xfer->rx.len, len > 8 ? len - 8 : 0);
65
66
 
66
67
 	/* Take a copy to the rx buffer.. */
67
68
 	memcpy_fromio(xfer->rx.buf, shmem->msg_payload + 4, xfer->rx.len);
..
..
@@ -70,8 +71,10 @@
70
71
 void shmem_fetch_notification(struct scmi_shared_mem __iomem *shmem,
71
72
 			      size_t max_len, struct scmi_xfer *xfer)
72
73
 {
74
+	size_t len = ioread32(&shmem->length);
75
+
73
76
 	/* Skip only the length of header in shmem area i.e 4 bytes */
74
-	xfer->rx.len = min_t(size_t, max_len, ioread32(&shmem->length) - 4);
77
+	xfer->rx.len = min_t(size_t, max_len, len > 4 ? len - 4 : 0);
75
78
 
76
79
 	/* Take a copy to the rx buffer.. */
77
80
 	memcpy_fromio(xfer->rx.buf, shmem->msg_payload, xfer->rx.len);