lkml.org 
[lkml]   [2022]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
From
On 21/12/2022 07:43, Jiri Slaby wrote:
> On 20. 12. 22, 17:15, Krzysztof Kozlowski wrote:
>> Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on
>> default RX FIFO depth, e.g. 16. Later during serial startup the
>> qcom_geni_serial_port_setup() updates the RX FIFO depth
>> (port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
> ...
>> If the RX FIFO depth changes after probe, be sure to resize the buffer.
>>
>> Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe")
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
>
> Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
>
> This patch LGTM, I only wonder:
>
>> --- a/drivers/tty/serial/qcom_geni_serial.c
>> +++ b/drivers/tty/serial/qcom_geni_serial.c
>> @@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
>> return IRQ_HANDLED;
>> }
>>
>> -static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
>> +static int get_tx_fifo_size(struct qcom_geni_serial_port *port)
>
> ... why is this function dubbed get_tx_fifo_size(), provided it handles
> rx fifo too? And it does not "get" the tx fifo size. In fact, the
> function sets that :).

I reads the FIFO sizes from the device registers, so I guess that was
behind the naming.

>
>> {
>> struct uart_port *uport;
>> + u32 old_rx_fifo_depth = port->rx_fifo_depth;
>>
>> uport = &port->uport;
>> port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
>> @@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
>> port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
>> uport->fifosize =
>> (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
>> +
>> + if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
>> + port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo,
>> + port->rx_fifo_depth * sizeof(u32),
>> + GFP_KERNEL);
>
> And now it even allocates memory.
>
> So more appropriate name should be setup_fifos() or similar.

Sure, I'll rename it and keep your Rb tag.

>

Best regards,
Krzysztof

\
 
 \ /
  Last update: 2023-03-26 23:16    [W:0.046 / U:0.672 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site