[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240110141146.6422e7517fe7e07a833b66df@hugovil.com>
Date: Wed, 10 Jan 2024 14:11:46 -0500
From: Hugo Villeneuve <hugo@...ovil.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Rengarajan S <rengarajan.s@...rochip.com>, Kumaravel Thiagarajan
<kumaravel.thiagarajan@...rochip.com>, Tharun Kumar P
<tharunkumar.pasumarthi@...rochip.com>, Greg Kroah-Hartman
<gregkh@...uxfoundation.org>, Jiri Slaby <jirislaby@...nel.org>,
linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] serial: 8250_pci1xxxx: off by one in
pci1xxxx_process_read_data()
On Wed, 10 Jan 2024 21:52:28 +0300
Dan Carpenter <dan.carpenter@...aro.org> wrote:
> These > comparisons should be >= to prevent writing one element beyond
> the end of the rx_buff[] array. The buffer has RX_BUF_SIZE[] elements.
Hi,
your commit title message is very confusing and doesn't hint that this
is a bug fix (or a potential bug fix)...
Hugo Villeneuve
>
> Fixes: aba8290f368d ("8250: microchip: pci1xxxx: Add Burst mode reception support in uart driver for writing into FIFO")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
> From static analysis, not testing.
>
> drivers/tty/serial/8250/8250_pci1xxxx.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/tty/serial/8250/8250_pci1xxxx.c b/drivers/tty/serial/8250/8250_pci1xxxx.c
> index 558c4c7f3104..cd258922bd78 100644
> --- a/drivers/tty/serial/8250/8250_pci1xxxx.c
> +++ b/drivers/tty/serial/8250/8250_pci1xxxx.c
> @@ -302,7 +302,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
> * to read, the data is received one byte at a time.
> */
> while (valid_burst_count--) {
> - if (*buff_index > (RX_BUF_SIZE - UART_BURST_SIZE))
> + if (*buff_index >= (RX_BUF_SIZE - UART_BURST_SIZE))
> break;
> burst_buf = (u32 *)&rx_buff[*buff_index];
> *burst_buf = readl(port->membase + UART_RX_BURST_FIFO);
> @@ -311,7 +311,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
> }
>
> while (*valid_byte_count) {
> - if (*buff_index > RX_BUF_SIZE)
> + if (*buff_index >= RX_BUF_SIZE)
> break;
> rx_buff[*buff_index] = readb(port->membase +
> UART_RX_BYTE_FIFO);
> --
> 2.43.0
>
>
Powered by blists - more mailing lists