lkml.org 
[lkml]   [2018]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 078/134] wil6210: fix memory access violation in wil_memcpy_from/toio_32
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dedy Lansky <qca_dlansky@qca.qualcomm.com>


    [ Upstream commit 0f6edfe2bbbb59d161580cb4870fcc46f5490f85 ]

    In case count is not multiple of 4, there is a read access in
    wil_memcpy_toio_32() from outside src buffer boundary.
    In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is
    a write access to outside dst io memory boundary.

    Fix these issues with proper handling of the last 1 to 4 copied bytes.

    Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
    Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
    Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/wireless/ath/wil6210/main.c | 20 +++++++++++++++++---
    1 file changed, 17 insertions(+), 3 deletions(-)

    --- a/drivers/net/wireless/ath/wil6210/main.c
    +++ b/drivers/net/wireless/ath/wil6210/main.c
    @@ -125,9 +125,15 @@ void wil_memcpy_fromio_32(void *dst, con
    u32 *d = dst;
    const volatile u32 __iomem *s = src;

    - /* size_t is unsigned, if (count%4 != 0) it will wrap */
    - for (count += 4; count > 4; count -= 4)
    + for (; count >= 4; count -= 4)
    *d++ = __raw_readl(s++);
    +
    + if (unlikely(count)) {
    + /* count can be 1..3 */
    + u32 tmp = __raw_readl(s);
    +
    + memcpy(d, &tmp, count);
    + }
    }

    void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
    @@ -136,8 +142,16 @@ void wil_memcpy_toio_32(volatile void __
    volatile u32 __iomem *d = dst;
    const u32 *s = src;

    - for (count += 4; count > 4; count -= 4)
    + for (; count >= 4; count -= 4)
    __raw_writel(*s++, d++);
    +
    + if (unlikely(count)) {
    + /* count can be 1..3 */
    + u32 tmp = 0;
    +
    + memcpy(&tmp, s, count);
    + __raw_writel(tmp, d);
    + }
    }

    static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,

    \
     
     \ /
      Last update: 2018-03-19 21:10    [W:4.137 / U:0.444 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site