Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe73b582 authored by Finn Thain's avatar Finn Thain Committed by Michael Ellerman
Browse files

via-cuda: Prevent read buffer overflow 



If the Cuda driver does not enter the 'read_done' state for some
reason, it may continue in the 'reading' state until the buffer
overflows. Add a bounds check to prevent this.

Tested-by: default avatarStan Johnson <userm57@yahoo.com>
Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent fd7a65a2

drivers/macintosh/via-cuda.c

+7 −1
Original line number Diff line number Diff line
@@ -470,6 +470,8 @@ cuda_poll(void) 
}

EXPORT_SYMBOL(cuda_poll);



#define ARRAY_FULL(a, p)	((p) - (a) == ARRAY_SIZE(a))



static irqreturn_t

cuda_interrupt(int irq, void *arg)

{
@@ -558,6 +560,10 @@ cuda_interrupt(int irq, void *arg) 
	break;



    case reading:

	if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr)

	                  : ARRAY_FULL(cuda_rbuf, reply_ptr))

	    (void)in_8(&via[SR]);

	else

	    *reply_ptr++ = in_8(&via[SR]);

	if (!TREQ_asserted(status)) {

	    /* that's all folks */