Files
Felix Fietkau 04017929f6 wifi: mt76: fix out-of-bounds access in mmio copy helpers
mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to
ALIGN(len, 4), so a length that is not a multiple of four reads past the
source buffer (write_copy) or writes past the destination (read_copy).
Copy the aligned body in the loop and handle the remaining tail through a
4-byte bounce buffer, keeping the register access width unchanged.

Fixes: 2df00805f7db ("wifi: mt76: mmio_*_copy fix byte order and alignment")
Signed-off-by: Felix Fietkau <[email protected]>
2026-07-24 14:45:25 +02:00

129 lines
2.7 KiB
C

// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (C) 2016 Felix Fietkau <[email protected]>
*/
#include "mt76.h"
#include "dma.h"
#include "trace.h"
static u32 mt76_mmio_rr(struct mt76_dev *dev, u32 offset)
{
u32 val;
val = readl(dev->mmio.regs + offset);
trace_reg_rr(dev, offset, val);
return val;
}
static void mt76_mmio_wr(struct mt76_dev *dev, u32 offset, u32 val)
{
trace_reg_wr(dev, offset, val);
writel(val, dev->mmio.regs + offset);
}
static u32 mt76_mmio_rmw(struct mt76_dev *dev, u32 offset, u32 mask, u32 val)
{
val |= mt76_mmio_rr(dev, offset) & ~mask;
mt76_mmio_wr(dev, offset, val);
return val;
}
static void mt76_mmio_write_copy(struct mt76_dev *dev, u32 offset,
const void *data, int len)
{
int i;
for (i = 0; i + 4 <= len; i += 4)
writel(get_unaligned_le32(data + i),
dev->mmio.regs + offset + i);
if (i < len) {
u8 tmp[4] = {};
memcpy(tmp, data + i, len - i);
writel(get_unaligned_le32(tmp), dev->mmio.regs + offset + i);
}
}
static void mt76_mmio_read_copy(struct mt76_dev *dev, u32 offset,
void *data, int len)
{
int i;
for (i = 0; i + 4 <= len; i += 4)
put_unaligned_le32(readl(dev->mmio.regs + offset + i),
data + i);
if (i < len) {
u8 tmp[4];
put_unaligned_le32(readl(dev->mmio.regs + offset + i), tmp);
memcpy(data + i, tmp, len - i);
}
}
static int mt76_mmio_wr_rp(struct mt76_dev *dev, u32 base,
const struct mt76_reg_pair *data, int len)
{
while (len > 0) {
mt76_mmio_wr(dev, data->reg, data->value);
data++;
len--;
}
return 0;
}
static int mt76_mmio_rd_rp(struct mt76_dev *dev, u32 base,
struct mt76_reg_pair *data, int len)
{
while (len > 0) {
data->value = mt76_mmio_rr(dev, data->reg);
data++;
len--;
}
return 0;
}
void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr,
u32 clear, u32 set)
{
unsigned long flags;
spin_lock_irqsave(&dev->mmio.irq_lock, flags);
dev->mmio.irqmask &= ~clear;
dev->mmio.irqmask |= set;
if (addr) {
if (mtk_wed_device_active(&dev->mmio.wed))
mtk_wed_device_irq_set_mask(&dev->mmio.wed,
dev->mmio.irqmask);
else
mt76_mmio_wr(dev, addr, dev->mmio.irqmask);
}
spin_unlock_irqrestore(&dev->mmio.irq_lock, flags);
}
EXPORT_SYMBOL_GPL(mt76_set_irq_mask);
void mt76_mmio_init(struct mt76_dev *dev, void __iomem *regs)
{
static const struct mt76_bus_ops mt76_mmio_ops = {
.rr = mt76_mmio_rr,
.rmw = mt76_mmio_rmw,
.wr = mt76_mmio_wr,
.write_copy = mt76_mmio_write_copy,
.read_copy = mt76_mmio_read_copy,
.wr_rp = mt76_mmio_wr_rp,
.rd_rp = mt76_mmio_rd_rp,
.type = MT76_BUS_MMIO,
};
dev->bus = &mt76_mmio_ops;
dev->mmio.regs = regs;
spin_lock_init(&dev->mmio.irq_lock);
}
EXPORT_SYMBOL_GPL(mt76_mmio_init);