Merge "wil6210: fix memory access violation in wil_memcpy_from/toio_32" into msm-4.9 (7574ff02) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/net/wireless/ath/wil6210/main.c

+17 −3

Original line number	Diff line number	Diff line
		@@ -130,9 +130,15 @@ void wil_memcpy_fromio_32(void dst, const volatile void __iomem src,
		u32 *d = dst;
		const volatile u32 __iomem *s = src;

		/* size_t is unsigned, if (count%4 != 0) it will wrap */
		for (count += 4; count > 4; count -= 4)
		for (; count >= 4; count -= 4)
		*d++ = __raw_readl(s++);

		if (unlikely(count)) {
		/* count can be 1..3 */
		u32 tmp = __raw_readl(s);

		memcpy(d, &tmp, count);
		}
		}

		void wil_memcpy_toio_32(volatile void __iomem dst, const void src,
		@@ -141,8 +147,16 @@ void wil_memcpy_toio_32(volatile void __iomem dst, const void src,
		volatile u32 __iomem *d = dst;
		const u32 *s = src;

		for (count += 4; count > 4; count -= 4)
		for (; count >= 4; count -= 4)
		__raw_writel(*s++, d++);

		if (unlikely(count)) {
		/* count can be 1..3 */
		u32 tmp = 0;

		memcpy(&tmp, s, count);
		__raw_writel(tmp, d);
		}
		}

		static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,