Commit ed7a8504 authored Nov 18, 2015 by Florian Achleitner Committed by Greg Kroah-Hartman Dec 13, 2015

sc16is7xx: Fix TX buffer overrun caused by wrong tx fifo level read-out



We found that our sc16is7xx on spi reported a TX fifo free space value
(TXLVL_REG) of 255 ocassionally, which is obviously wrong, with a
64 byte fifo and caused a buffer overrun and a kernel crash.

To trigger this, a large write to the tty is sufficient. The fifo fills,
TXLVL_REG reads zero, but the handle_tx function does a zero-data-length
write to the TX fifo anyways through sc16is7xx_fifo_write. The next
TXLVL_REG read then yields 255, for unknown reasons. A subsequent read
is ok.

Prevent zero-data-length writes if the TX fifo is full, because they are
pointless, and because they trigger wrong TXLVL read-outs.

Furthermore, prevent a TX buffer overrun if the peripheral reports values
larger than the buffer size and thus, don't allow the peripheral to crash
the kernel.

Signed-off-by: Florian Achleitner <achleitner.florian@fronius.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 63d8cb3f

drivers/tty/serial/sc16is7xx.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -389,6 +389,13 @@ static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send)
		const u8 line = sc16is7xx_line(port);
		u8 addr = (SC16IS7XX_THR_REG << SC16IS7XX_REG_SHIFT) \| line;

		/*
		* Don't send zero-length data, at least on SPI it confuses the chip
		* delivering wrong TXLVL data.
		*/
		if (unlikely(!to_send))
		return;

		regcache_cache_bypass(s->regmap, true);
		regmap_raw_write(s->regmap, addr, s->buf, to_send);
		regcache_cache_bypass(s->regmap, false);
		@@ -630,6 +637,12 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
		if (likely(to_send)) {
		/* Limit to size of TX FIFO */
		txlen = sc16is7xx_port_read(port, SC16IS7XX_TXLVL_REG);
		if (txlen > SC16IS7XX_FIFO_SIZE) {
		dev_err_ratelimited(port->dev,
		"chip reports %d free bytes in TX fifo, but it only has %d",
		txlen, SC16IS7XX_FIFO_SIZE);
		txlen = 0;
		}
		to_send = (to_send > txlen) ? txlen : to_send;

		/* Add data to send */