From fe73b582f179354e233e5deddbd274efe8d3bbb9 Mon Sep 17 00:00:00 2001 From: Finn Thain Date: Sat, 31 Dec 2016 19:56:26 -0500 Subject: via-cuda: Prevent read buffer overflow If the Cuda driver does not enter the 'read_done' state for some reason, it may continue in the 'reading' state until the buffer overflows. Add a bounds check to prevent this. Tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: Michael Ellerman --- drivers/macintosh/via-cuda.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c index 64a04af248a1..1cf1467cf6e5 100644 --- a/drivers/macintosh/via-cuda.c +++ b/drivers/macintosh/via-cuda.c @@ -470,6 +470,8 @@ cuda_poll(void) } EXPORT_SYMBOL(cuda_poll); +#define ARRAY_FULL(a, p) ((p) - (a) == ARRAY_SIZE(a)) + static irqreturn_t cuda_interrupt(int irq, void *arg) { @@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg) break; case reading: - *reply_ptr++ = in_8(&via[SR]); + if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr) + : ARRAY_FULL(cuda_rbuf, reply_ptr)) + (void)in_8(&via[SR]); + else + *reply_ptr++ = in_8(&via[SR]); if (!TREQ_asserted(status)) { /* that's all folks */ negate_TIP_and_TACK(); -- cgit