UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

ath10k: sanitize tx ring index access properly 

The tx ring index was immediately trimmed with a
bitmask. This discarded the 0xFFFFFFFF error case
(which theoretically can happen when a device is
abruptly disconnected) and led to using an invalid
tx ring index. This could lead to memory
corruption.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This commit is contained in:
Michal Kazior 2014-07-14 16:25:25 +03:00 committed by Kalle Valo
parent 2374b18684
commit 9936194437
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/wireless/ath/ath10k/ce.c
View File

@ -603,16 +603,19 @@ static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
if (ret) if (ret)
return ret; return ret;
src_ring->hw_index = read_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
ath10k_ce_src_ring_read_index_get(ar, ctrl_addr); if (read_index == 0xffffffff)
src_ring->hw_index &= nentries_mask; return -ENODEV;
read_index &= nentries_mask;
src_ring->hw_index = read_index;
ath10k_pci_sleep(ar); ath10k_pci_sleep(ar);
} }
read_index = src_ring->hw_index; read_index = src_ring->hw_index;
if ((read_index == sw_index) || (read_index == 0xffffffff)) if (read_index == sw_index)
return -EIO; return -EIO;
sbase = src_ring->shadow_base; sbase = src_ring->shadow_base;