gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: fix out-of-bounds access in mmio copy helpers

Browse Source 
mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to
ALIGN(len, 4), so a length that is not a multiple of four reads past the
source buffer (write_copy) or writes past the destination (read_copy).
Copy the aligned body in the loop and handle the remaining tail through a
4-byte bounce buffer, keeping the register access width unchanged.

Fixes: 2df00805f7db ("wifi: mt76: mmio_*_copy fix byte order and alignment")
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2026-07-24 14:45:25 +02:00
parent 48c4d99acd
commit 04017929f6
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mmio.c
+16 -2
View File
@@ -35,9 +35,16 @@ static void mt76_mmio_write_copy(struct mt76_dev *dev, u32 offset,
{ {
int i; int i;
for (i = 0; i < ALIGN(len, 4); i += 4) for (i = 0; i + 4 <= len; i += 4)
writel(get_unaligned_le32(data + i), writel(get_unaligned_le32(data + i),
dev->mmio.regs + offset + i); dev->mmio.regs + offset + i);
if (i < len) {
u8 tmp[4] = {};
memcpy(tmp, data + i, len - i);
writel(get_unaligned_le32(tmp), dev->mmio.regs + offset + i);
}
} }
static void mt76_mmio_read_copy(struct mt76_dev *dev, u32 offset, static void mt76_mmio_read_copy(struct mt76_dev *dev, u32 offset,
@@ -45,9 +52,16 @@ static void mt76_mmio_read_copy(struct mt76_dev *dev, u32 offset,
{ {
int i; int i;
for (i = 0; i < ALIGN(len, 4); i += 4) for (i = 0; i + 4 <= len; i += 4)
put_unaligned_le32(readl(dev->mmio.regs + offset + i), put_unaligned_le32(readl(dev->mmio.regs + offset + i),
data + i); data + i);
if (i < len) {
u8 tmp[4];
put_unaligned_le32(readl(dev->mmio.regs + offset + i), tmp);
memcpy(data + i, tmp, len - i);
}
} }
static int mt76_mmio_wr_rp(struct mt76_dev *dev, u32 base, static int mt76_mmio_wr_rp(struct mt76_dev *dev, u32 base,