mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 07:03:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: fix out-of-bounds access in mmio copy helpers

Browse Source 
mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to
ALIGN(len, 4), so a length that is not a multiple of four reads past the
source buffer (write_copy) or writes past the destination (read_copy).
Copy the aligned body in the loop and handle the remaining tail through a
4-byte bounce buffer, keeping the register access width unchanged.

Fixes: 2df00805f7 ("wifi: mt76: mmio_*_copy fix byte order and alignment")
Link: https://patch.msgid.link/20260724124813.3961474-3-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau
2026-07-24 12:47:47 +00:00
parent 44af52467e
commit 6689b4a65e
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/wireless/mediatek/mt76/mmio.c
View File

@@ -35,9 +35,16 @@ static void mt76_mmio_write_copy(struct mt76_dev *dev, u32 offset,
{
int i;
for (i = 0; i < ALIGN(len, 4); i += 4)
for (i = 0; i + 4 <= len; i += 4)
writel(get_unaligned_le32(data + i),
dev->mmio.regs + offset + i);
if (i < len) {
u8 tmp[4] = {};
memcpy(tmp, data + i, len - i);
writel(get_unaligned_le32(tmp), dev->mmio.regs + offset + i);
}
}
static void mt76_mmio_read_copy(struct mt76_dev *dev, u32 offset,
@@ -45,9 +52,16 @@ static void mt76_mmio_read_copy(struct mt76_dev *dev, u32 offset,
{
int i;
for (i = 0; i < ALIGN(len, 4); i += 4)
for (i = 0; i + 4 <= len; i += 4)
put_unaligned_le32(readl(dev->mmio.regs + offset + i),
data + i);
if (i < len) {
u8 tmp[4];
put_unaligned_le32(readl(dev->mmio.regs + offset + i), tmp);
memcpy(data + i, tmp, len - i);
}
}
static int mt76_mmio_wr_rp(struct mt76_dev *dev, u32 base,