Commit 86ee55e9 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

serial: 8250_pci1xxxx: fix off by one in pci1xxxx_process_read_data() 



These > comparisons should be >= to prevent writing one element beyond
the end of the rx_buff[] array.  The rx_buff[] buffer has RX_BUF_SIZE
elements.  Fix the buffer overflow.

Fixes: aba8290f ("8250: microchip: pci1xxxx: Add Burst mode reception support in uart driver for writing into FIFO")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/ZZ7vIfj7Jgh-pJn8@moroto


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e15c99be

drivers/tty/serial/8250/8250_pci1xxxx.c

+2 −2
Original line number Diff line number Diff line
@@ -302,7 +302,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port, 
	 * to read, the data is received one byte at a time.

	 */

	while (valid_burst_count--) {

		if (*buff_index > (RX_BUF_SIZE - UART_BURST_SIZE))

		if (*buff_index >= (RX_BUF_SIZE - UART_BURST_SIZE))

			break;

		burst_buf = (u32 *)&rx_buff[*buff_index];

		*burst_buf = readl(port->membase + UART_RX_BURST_FIFO);
@@ -311,7 +311,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port, 
	}



	while (*valid_byte_count) {

		if (*buff_index > RX_BUF_SIZE)

		if (*buff_index >= RX_BUF_SIZE)

			break;

		rx_buff[*buff_index] = readb(port->membase +

					     UART_RX_BYTE_FIFO);