Commit 0f6edfe2 authored by Dedy Lansky's avatar Dedy Lansky Committed by Kalle Valo
Browse files

wil6210: fix memory access violation in wil_memcpy_from/toio_32 



In case count is not multiple of 4, there is a read access in
wil_memcpy_toio_32() from outside src buffer boundary.
In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is
a write access to outside dst io memory boundary.

Fix these issues with proper handling of the last 1 to 4 copied bytes.

Signed-off-by: default avatarDedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: default avatarMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent 4d4f8132

drivers/net/wireless/ath/wil6210/main.c

+17 −3
Original line number Diff line number Diff line
@@ -130,9 +130,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src, 
	u32 *d = dst;

	const volatile u32 __iomem *s = src;



	/* size_t is unsigned, if (count%4 != 0) it will wrap */

	for (count += 4; count > 4; count -= 4)

	for (; count >= 4; count -= 4)

		*d++ = __raw_readl(s++);



	if (unlikely(count)) {

		/* count can be 1..3 */

		u32 tmp = __raw_readl(s);



		memcpy(d, &tmp, count);

	}

}



void wil_memcpy_fromio_halp_vote(struct wil6210_priv *wil, void *dst,
@@ -149,8 +155,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src, 
	volatile u32 __iomem *d = dst;

	const u32 *s = src;



	for (count += 4; count > 4; count -= 4)

	for (; count >= 4; count -= 4)

		__raw_writel(*s++, d++);



	if (unlikely(count)) {

		/* count can be 1..3 */

		u32 tmp = 0;



		memcpy(&tmp, s, count);

		__raw_writel(tmp, d);

	}

}



void wil_memcpy_toio_halp_vote(struct wil6210_priv *wil,