diff options
| author | Finn Thain <fthain@telegraphics.com.au> | 2017-01-01 03:56:26 +0300 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2017-02-07 08:56:19 +0300 |
| commit | fe73b582f179354e233e5deddbd274efe8d3bbb9 (patch) | |
| tree | 508e70bc6bc1e696ce0dc7143920ec97e49b929a /drivers/macintosh | |
| parent | fd7a65a27c6cb9b0920130d9402b95695168092d (diff) | |
| download | linux-fe73b582f179354e233e5deddbd274efe8d3bbb9.tar.xz | |
via-cuda: Prevent read buffer overflow
If the Cuda driver does not enter the 'read_done' state for some
reason, it may continue in the 'reading' state until the buffer
overflows. Add a bounds check to prevent this.
Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Diffstat (limited to 'drivers/macintosh')
| -rw-r--r-- | drivers/macintosh/via-cuda.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c index 64a04af248a1..1cf1467cf6e5 100644 --- a/drivers/macintosh/via-cuda.c +++ b/drivers/macintosh/via-cuda.c @@ -470,6 +470,8 @@ cuda_poll(void) } EXPORT_SYMBOL(cuda_poll); +#define ARRAY_FULL(a, p) ((p) - (a) == ARRAY_SIZE(a)) + static irqreturn_t cuda_interrupt(int irq, void *arg) { @@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg) break; case reading: - *reply_ptr++ = in_8(&via[SR]); + if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr) + : ARRAY_FULL(cuda_rbuf, reply_ptr)) + (void)in_8(&via[SR]); + else + *reply_ptr++ = in_8(&via[SR]); if (!TREQ_asserted(status)) { /* that's all folks */ negate_TIP_and_TACK(); |