[PATCH RESEND 04/10] via-cuda: Prevent read buffer overflow

Path	csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From	Finn Thain <fthain@telegraphics.com.au>
Newsgroups	linux.kernel
Subject	[PATCH RESEND 04/10] via-cuda: Prevent read buffer overflow
Date	Sun, 01 Jan 2017 02:00:01 +0100
Message-ID	<sUCFb-1FL-9@gated-at.bofh.it> (permalink)
References	<sUCFb-1FL-3@gated-at.bofh.it>
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	38
Organization	linux.* mail to news gateway
X-Original-Cc	linux-m68k@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org
X-Original-Date	Sat, 31 Dec 2016 19:56:26 -0500 (EST)
X-Original-Message-ID	<0f17040d7530acb6f3ebd7b592cca8dfb21d2b64.1483055859.git.fthain@telegraphics.com.au>
X-Original-References	<cover.1483055859.git.fthain@telegraphics.com.au>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1548849

Show key headers only | View raw

If the Cuda driver does not enter the 'read_done' state for some
reason, it may continue in the 'reading' state until the buffer
overflows. Add a bounds check to prevent this.

Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
---
 drivers/macintosh/via-cuda.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c
index 64a04af..1cf1467 100644
--- a/drivers/macintosh/via-cuda.c
+++ b/drivers/macintosh/via-cuda.c
@@ -470,6 +470,8 @@ cuda_poll(void)
 }
 EXPORT_SYMBOL(cuda_poll);
 
+#define ARRAY_FULL(a, p)	((p) - (a) == ARRAY_SIZE(a))
+
 static irqreturn_t
 cuda_interrupt(int irq, void *arg)
 {
@@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg)
 	break;
 
     case reading:
-	*reply_ptr++ = in_8(&via[SR]);
+	if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr)
+	                  : ARRAY_FULL(cuda_rbuf, reply_ptr))
+	    (void)in_8(&via[SR]);
+	else
+	    *reply_ptr++ = in_8(&via[SR]);
 	if (!TREQ_asserted(status)) {
 	    /* that's all folks */
 	    negate_TIP_and_TACK();
-- 
2.10.2

Thread

[PATCH RESEND 00/10] Replace via-maciisi with via-cuda driver Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 04/10] via-cuda: Prevent read buffer overflow Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 10/10] m68k/mac: Replace via-maciisi driver with  via-cuda driver Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
    Re: [PATCH RESEND 10/10] m68k/mac: Replace via-maciisi driver with  via-cuda driver Geert Uytterhoeven <geert@linux-m68k.org> - 2017-01-02 11:30 +0100
      Re: [PATCH RESEND 10/10] m68k/mac: Replace via-maciisi driver with  via-cuda driver Finn Thain <fthain@telegraphics.com.au> - 2017-01-03 01:40 +0100
  [PATCH RESEND 05/10] via-cuda: Fix re-initialization of reply_ptr and  reading_reply Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 08/10] via-cuda: Initialize data_index early and  increment consistently Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 02/10] via-cuda: Remove redundant temporary variable Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 01/10] via-cuda: Cleanup printk calls Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 09/10] via-cuda: Add support for Egret system  controller Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 03/10] via-cuda: Add TREQ, TIP and TACK signal helpers Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100
  [PATCH RESEND 07/10] via-cuda: Use spinlock_irq_save/restore instead  of enable/disable_irq Finn Thain <fthain@telegraphics.com.au> - 2017-01-01 02:00 +0100

csiph-web