summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@linaro.org>2024-01-10 22:25:21 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2024-01-27 19:08:16 -0800
commit86ee55e9bc7ff7308eda67e5bcb3f8c834c7c113 (patch)
tree34c5a9392642fc66f87dac12094af673ba633a5a
parente15c99be0c915bbe70dfe55450d268d7bd5bdac8 (diff)
downloadlinux-stable-86ee55e9bc7ff7308eda67e5bcb3f8c834c7c113.tar.gz
linux-stable-86ee55e9bc7ff7308eda67e5bcb3f8c834c7c113.tar.bz2
linux-stable-86ee55e9bc7ff7308eda67e5bcb3f8c834c7c113.zip
serial: 8250_pci1xxxx: fix off by one in pci1xxxx_process_read_data()
These > comparisons should be >= to prevent writing one element beyond the end of the rx_buff[] array. The rx_buff[] buffer has RX_BUF_SIZE elements. Fix the buffer overflow. Fixes: aba8290f368d ("8250: microchip: pci1xxxx: Add Burst mode reception support in uart driver for writing into FIFO") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/ZZ7vIfj7Jgh-pJn8@moroto Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/tty/serial/8250/8250_pci1xxxx.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/tty/serial/8250/8250_pci1xxxx.c b/drivers/tty/serial/8250/8250_pci1xxxx.c
index 558c4c7f3104..cd258922bd78 100644
--- a/drivers/tty/serial/8250/8250_pci1xxxx.c
+++ b/drivers/tty/serial/8250/8250_pci1xxxx.c
@@ -302,7 +302,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
* to read, the data is received one byte at a time.
*/
while (valid_burst_count--) {
- if (*buff_index > (RX_BUF_SIZE - UART_BURST_SIZE))
+ if (*buff_index >= (RX_BUF_SIZE - UART_BURST_SIZE))
break;
burst_buf = (u32 *)&rx_buff[*buff_index];
*burst_buf = readl(port->membase + UART_RX_BURST_FIFO);
@@ -311,7 +311,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
}
while (*valid_byte_count) {
- if (*buff_index > RX_BUF_SIZE)
+ if (*buff_index >= RX_BUF_SIZE)
break;
rx_buff[*buff_index] = readb(port->membase +
UART_RX_BYTE_FIFO);