lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0470/1039] char/mwave: Adjust io port register size
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ]

    Using MKWORD() on a byte-sized variable results in OOB read. Expand the
    size of the reserved area so both MKWORD and MKBYTE continue to work
    without overflow. Silences this warning on a -Warray-bounds build:

    drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned int[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werror=array-bounds]
    346 | #define MKWORD(var) (*((unsigned short *)(&var)))
    | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
    drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp'
    356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index)
    | ^~~~~
    drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD'
    373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl));
    | ^~~~~~
    drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl'
    358 | DSP_ISA_SLAVE_CONTROL rSlaveControl;
    | ^~~~~~~~~~~~~

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/char/mwave/3780i.h | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h
    index 9ccb6b270b071..95164246afd1a 100644
    --- a/drivers/char/mwave/3780i.h
    +++ b/drivers/char/mwave/3780i.h
    @@ -68,7 +68,7 @@ typedef struct {
    unsigned char ClockControl:1; /* RW: Clock control: 0=normal, 1=stop 3780i clocks */
    unsigned char SoftReset:1; /* RW: Soft reset 0=normal, 1=soft reset active */
    unsigned char ConfigMode:1; /* RW: Configuration mode, 0=normal, 1=config mode */
    - unsigned char Reserved:5; /* 0: Reserved */
    + unsigned short Reserved:13; /* 0: Reserved */
    } DSP_ISA_SLAVE_CONTROL;


    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 23:10    [W:2.725 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site