github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wil6210: fix memory access violation in wil_memcpy_from/toio_32

Browse Source 
[ Upstream commit 0f6edfe2bb ]

In case count is not multiple of 4, there is a read access in
wil_memcpy_toio_32() from outside src buffer boundary.
In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is
a write access to outside dst io memory boundary.

Fix these issues with proper handling of the last 1 to 4 copied bytes.

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dedy Lansky 2017-04-05 14:58:11 +03:00 committed by Greg Kroah-Hartman
parent 51dd2600cc
commit a5fc0f0e82
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/net/wireless/ath/wil6210/main.c
View File

@ -125,9 +125,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
u32 *d = dst;
const volatile u32 __iomem *s = src;
/* size_t is unsigned, if (count%4 != 0) it will wrap */
for (count += 4; count > 4; count -= 4)
for (; count >= 4; count -= 4)
*d++ = __raw_readl(s++);
if (unlikely(count)) {
/* count can be 1..3 */
u32 tmp = __raw_readl(s);
memcpy(d, &tmp, count);
}
}
void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
@ -136,8 +142,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
volatile u32 __iomem *d = dst;
const u32 *s = src;
for (count += 4; count > 4; count -= 4)
for (; count >= 4; count -= 4)
__raw_writel(*s++, d++);
if (unlikely(count)) {
/* count can be 1..3 */
u32 tmp = 0;
memcpy(&tmp, s, count);
__raw_writel(tmp, d);
}
}
static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,