leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

via-cuda: Prevent read buffer overflow

Browse Source 
If the Cuda driver does not enter the 'read_done' state for some
reason, it may continue in the 'reading' state until the buffer
overflows. Add a bounds check to prevent this.

Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
This commit is contained in:
Finn Thain 2016-12-31 19:56:26 -05:00 committed by Michael Ellerman
parent fd7a65a27c
commit fe73b582f1
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/macintosh/via-cuda.c
View File

@ -470,6 +470,8 @@ cuda_poll(void)
} }
EXPORT_SYMBOL(cuda_poll); EXPORT_SYMBOL(cuda_poll);
#define ARRAY_FULL(a, p) ((p) - (a) == ARRAY_SIZE(a))
static irqreturn_t static irqreturn_t
cuda_interrupt(int irq, void *arg) cuda_interrupt(int irq, void *arg)
{ {
@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg)
break; break;
case reading: case reading:
*reply_ptr++ = in_8(&via[SR]); if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr)
: ARRAY_FULL(cuda_rbuf, reply_ptr))
(void)in_8(&via[SR]);
else
*reply_ptr++ = in_8(&via[SR]);
if (!TREQ_asserted(status)) { if (!TREQ_asserted(status)) {
/* that's all folks */ /* that's all folks */
negate_TIP_and_TACK(); negate_TIP_and_TACK();