Commit fe73b582 authored by Finn Thain's avatar Finn Thain Committed by Michael Ellerman

via-cuda: Prevent read buffer overflow

If the Cuda driver does not enter the 'read_done' state for some
reason, it may continue in the 'reading' state until the buffer
overflows. Add a bounds check to prevent this.
Tested-by: default avatarStan Johnson <userm57@yahoo.com>
Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent fd7a65a2
...@@ -470,6 +470,8 @@ cuda_poll(void) ...@@ -470,6 +470,8 @@ cuda_poll(void)
} }
EXPORT_SYMBOL(cuda_poll); EXPORT_SYMBOL(cuda_poll);
#define ARRAY_FULL(a, p) ((p) - (a) == ARRAY_SIZE(a))
static irqreturn_t static irqreturn_t
cuda_interrupt(int irq, void *arg) cuda_interrupt(int irq, void *arg)
{ {
...@@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg) ...@@ -558,7 +560,11 @@ cuda_interrupt(int irq, void *arg)
break; break;
case reading: case reading:
*reply_ptr++ = in_8(&via[SR]); if (reading_reply ? ARRAY_FULL(current_req->reply, reply_ptr)
: ARRAY_FULL(cuda_rbuf, reply_ptr))
(void)in_8(&via[SR]);
else
*reply_ptr++ = in_8(&via[SR]);
if (!TREQ_asserted(status)) { if (!TREQ_asserted(status)) {
/* that's all folks */ /* that's all folks */
negate_TIP_and_TACK(); negate_TIP_and_TACK();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment