summaryrefslogtreecommitdiff
path: root/drivers/macintosh
diff options
context:
space:
mode:
authorFinn Thain <fthain@telegraphics.com.au>2016-12-31 19:56:26 -0500
committerMichael Ellerman <mpe@ellerman.id.au>2017-02-07 16:56:19 +1100
commitfe73b582f179354e233e5deddbd274efe8d3bbb9 (patch)
tree508e70bc6bc1e696ce0dc7143920ec97e49b929a /drivers/macintosh
parentfd7a65a27c6cb9b0920130d9402b95695168092d (diff)
via-cuda: Prevent read buffer overflow
If the Cuda driver does not enter the 'read_done' state for some reason, it may continue in the 'reading' state until the buffer overflows. Add a bounds check to prevent this. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Diffstat (limited to 'drivers/macintosh')
-rw-r--r--drivers/macintosh/via-cuda.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c
index 64a04af248a1..1cf1467cf6e5 100644
--- a/drivers/macintosh/via-cuda.c
+++ b/drivers/macintosh/via-cuda.c
@@ -470,6 +470,8 @@ cuda_poll(void)
}
EXPORT_SYMBOL(cuda_poll);
+#define ARRAY_FULL(a, p) ((p) - (a) == ARRAY_SIZE(a))
+
static irqreturn_t
cuda_interrupt(int irq, void *arg)
{
@@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg)
break;
case reading:
- *reply_ptr++ = in_8(&via[SR]);
+ if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr)
+ : ARRAY_FULL(cuda_rbuf, reply_ptr))
+ (void)in_8(&via[SR]);
+ else
+ *reply_ptr++ = in_8(&via[SR]);
if (!TREQ_asserted(status)) {
/* that's all folks */
negate_TIP_and_TACK();