Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82047212 authored by Dedy Lansky's avatar Dedy Lansky Committed by Maya Erez
Browse files

wil6210: fix memory access violation in wil_memcpy_from/toio_32 



In case count is not multiple of 4, there is a read access in
wil_memcpy_toio_32() from outside src buffer boundary.
In wil_memcpy_fromio_32(), in case count is not multiple of 4, there
is a write access to outside dst io memory boundary.

Fix these issues with proper handling of the last 1 to 4 copied bytes.

Change-Id: Iff7853bc4803a01449ddcee996a54a0dccc1db1a
Signed-off-by: default avatarDedy Lansky <dlansky@codeaurora.org>
parent 1b75271b

drivers/net/wireless/ath/wil6210/main.c

+17 −3
Original line number Diff line number Diff line
@@ -130,9 +130,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src, 
	u32 *d = dst;

	const volatile u32 __iomem *s = src;



	/* size_t is unsigned, if (count%4 != 0) it will wrap */

	for (count += 4; count > 4; count -= 4)

	for (; count >= 4; count -= 4)

		*d++ = __raw_readl(s++);



	if (unlikely(count)) {

		/* count can be 1..3 */

		u32 tmp = __raw_readl(s);



		memcpy(d, &tmp, count);

	}

}



void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
@@ -141,8 +147,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src, 
	volatile u32 __iomem *d = dst;

	const u32 *s = src;



	for (count += 4; count > 4; count -= 4)

	for (; count >= 4; count -= 4)

		__raw_writel(*s++, d++);



	if (unlikely(count)) {

		/* count can be 1..3 */

		u32 tmp = 0;



		memcpy(&tmp, s, count);

		__raw_writel(tmp, d);

	}

}



static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,