From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-bn3nam01on0102.outbound.protection.outlook.com ([104.47.33.102]:44208 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751297AbeCHFAN (ORCPT ); Thu, 8 Mar 2018 00:00:13 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Dedy Lansky , Maya Erez , Kalle Valo , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 022/190] wil6210: fix memory access violation in wil_memcpy_from/toio_32 Date: Thu, 8 Mar 2018 04:58:59 +0000 Message-ID: <20180308045810.8041-22-alexander.levin@microsoft.com> References: <20180308045810.8041-1-alexander.levin@microsoft.com> In-Reply-To: <20180308045810.8041-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Dedy Lansky [ Upstream commit 0f6edfe2bbbb59d161580cb4870fcc46f5490f85 ] In case count is not multiple of 4, there is a read access in wil_memcpy_toio_32() from outside src buffer boundary. In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is a write access to outside dst io memory boundary. Fix these issues with proper handling of the last 1 to 4 copied bytes. Signed-off-by: Dedy Lansky Signed-off-by: Maya Erez Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/wil6210/main.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless= /ath/wil6210/main.c index 24b07a0ce6f7..f8bce58d48cc 100644 --- a/drivers/net/wireless/ath/wil6210/main.c +++ b/drivers/net/wireless/ath/wil6210/main.c @@ -129,9 +129,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile vo= id __iomem *src, u32 *d =3D dst; const volatile u32 __iomem *s =3D src; =20 - /* size_t is unsigned, if (count%4 !=3D 0) it will wrap */ - for (count +=3D 4; count > 4; count -=3D 4) + for (; count >=3D 4; count -=3D 4) *d++ =3D __raw_readl(s++); + + if (unlikely(count)) { + /* count can be 1..3 */ + u32 tmp =3D __raw_readl(s); + + memcpy(d, &tmp, count); + } } =20 void wil_memcpy_fromio_halp_vote(struct wil6210_priv *wil, void *dst, @@ -148,8 +154,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, co= nst void *src, volatile u32 __iomem *d =3D dst; const u32 *s =3D src; =20 - for (count +=3D 4; count > 4; count -=3D 4) + for (; count >=3D 4; count -=3D 4) __raw_writel(*s++, d++); + + if (unlikely(count)) { + /* count can be 1..3 */ + u32 tmp =3D 0; + + memcpy(&tmp, s, count); + __raw_writel(tmp, d); + } } =20 void wil_memcpy_toio_halp_vote(struct wil6210_priv *wil, --=20 2.14.1