netdev - [PATCH wireless-drivers-next 3/4] net: wlcore: fix bug reading fwlog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <E1lolvc-0003RM-VE@rmk-PC.armlinux.org.uk>
Date:   Thu, 03 Jun 2021 12:54:24 +0100
From:   Russell King <rmk+kernel@...linux.org.uk>
To:     Kalle Valo <kvalo@...eaurora.org>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org
Subject: [PATCH wireless-drivers-next 3/4] net: wlcore: fix bug reading fwlog

With logging enabled, it has been observed that the driver spews
messages such as:

wlcore: ERROR Calculate of clear addr Clear = 204025b0, write = 204015b0

The problem occurs because 204025b0 is the end of the buffer, and
204015b0 is the beginning, and the calculation for "clear"ing the
buffer does not take into account that if we read to the very end
of the ring buffer, we are actually at the beginning of the buffer.

Fix this.

Signed-off-by: Russell King <rmk+kernel@...linux.org.uk>
---
 drivers/net/wireless/ti/wlcore/event.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 875198fb1480..8a67a708c96e 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -84,6 +84,8 @@ int wlcore_event_fw_logger(struct wl1271 *wl)
 	len = min(actual_len, available_len);
 	wl12xx_copy_fwlog(wl, &buffer[start_loc], len);
 	clear_ptr = addr_ptr + start_loc + actual_len;
+	if (clear_ptr == buff_end_ptr)
+		clear_ptr = buff_start_ptr;
 
 	/* Copy any remaining part from beginning of ring buffer */
 	len = actual_len - len;
-- 
2.20.1