[PATCH AUTOSEL for 4.9 022/190] wil6210: fix memory access violation in wil_memcpy_from/toio_32

[Sasha Levin]

From: Dedy Lansky 

[ Upstream commit 0f6edfe259d161580cb4870fcc46f5490f85 ]

In case count is not multiple of 4, there is a read access in
wil_memcpy_toio_32() from outside src buffer boundary.
In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is
a write access to outside dst io memory boundary.

Fix these issues with proper handling of the last 1 to 4 copied bytes.

Signed-off-by: Dedy Lansky 
Signed-off-by: Maya Erez 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/ath/wil6210/main.c | 20 +---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/main.c 
b/drivers/net/wireless/ath/wil6210/main.c
index 24b07a0ce6f7..f8bce58d48cc 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -129,9 +129,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void 
__iomem *src,
u32 *d = dst;
const volatile u32 __iomem *s = src;
 
-   /* size_t is unsigned, if (count%4 != 0) it will wrap */
-   for (count += 4; count > 4; count -= 4)
+   for (; count >= 4; count -= 4)
*d++ = __raw_readl(s++);
+
+   if (unlikely(count)) {
+   /* count can be 1..3 */
+   u32 tmp = __raw_readl(s);
+
+   memcpy(d, , count);
+   }
 }
 
 void wil_memcpy_fromio_halp_vote(struct wil6210_priv *wil, void *dst,
@@ -148,8 +154,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const 
void *src,
volatile u32 __iomem *d = dst;
const u32 *s = src;
 
-   for (count += 4; count > 4; count -= 4)
+   for (; count >= 4; count -= 4)
__raw_writel(*s++, d++);
+
+   if (unlikely(count)) {
+   /* count can be 1..3 */
+   u32 tmp = 0;
+
+   memcpy(, s, count);
+   __raw_writel(tmp, d);
+   }
 }
 
 void wil_memcpy_toio_halp_vote(struct wil6210_priv *wil,
-- 
2.14.1

[PATCH AUTOSEL for 4.9 022/190] wil6210: fix memory access violation in wil_memcpy_from/toio_32

[Sasha Levin]

From: Dedy Lansky 

[ Upstream commit 0f6edfe259d161580cb4870fcc46f5490f85 ]

In case count is not multiple of 4, there is a read access in
wil_memcpy_toio_32() from outside src buffer boundary.
In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is
a write access to outside dst io memory boundary.

Fix these issues with proper handling of the last 1 to 4 copied bytes.

Signed-off-by: Dedy Lansky 
Signed-off-by: Maya Erez 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/ath/wil6210/main.c | 20 +---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/main.c 
b/drivers/net/wireless/ath/wil6210/main.c
index 24b07a0ce6f7..f8bce58d48cc 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -129,9 +129,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void 
__iomem *src,
u32 *d = dst;
const volatile u32 __iomem *s = src;
 
-   /* size_t is unsigned, if (count%4 != 0) it will wrap */
-   for (count += 4; count > 4; count -= 4)
+   for (; count >= 4; count -= 4)
*d++ = __raw_readl(s++);
+
+   if (unlikely(count)) {
+   /* count can be 1..3 */
+   u32 tmp = __raw_readl(s);
+
+   memcpy(d, , count);
+   }
 }
 
 void wil_memcpy_fromio_halp_vote(struct wil6210_priv *wil, void *dst,
@@ -148,8 +154,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const 
void *src,
volatile u32 __iomem *d = dst;
const u32 *s = src;
 
-   for (count += 4; count > 4; count -= 4)
+   for (; count >= 4; count -= 4)
__raw_writel(*s++, d++);
+
+   if (unlikely(count)) {
+   /* count can be 1..3 */
+   u32 tmp = 0;
+
+   memcpy(, s, count);
+   __raw_writel(tmp, d);
+   }
 }
 
 void wil_memcpy_toio_halp_vote(struct wil6210_priv *wil,
-- 
2.14.1