serial: 8250_pci1xxxx: off by one in pci1xxxx_process_read_data()

[PATCH] serial: 8250_pci1xxxx: off by one in pci1xxxx_process_read_data()

Posted by Dan Carpenter 1 year, 11 months ago

These > comparisons should be >= to prevent writing one element beyond
the end of the rx_buff[] array.  The buffer has RX_BUF_SIZE[] elements.

Fixes: aba8290f368d ("8250: microchip: pci1xxxx: Add Burst mode reception support in uart driver for writing into FIFO")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
From static analysis, not testing.

 drivers/tty/serial/8250/8250_pci1xxxx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_pci1xxxx.c b/drivers/tty/serial/8250/8250_pci1xxxx.c
index 558c4c7f3104..cd258922bd78 100644
--- a/drivers/tty/serial/8250/8250_pci1xxxx.c
+++ b/drivers/tty/serial/8250/8250_pci1xxxx.c
@@ -302,7 +302,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
 	 * to read, the data is received one byte at a time.
 	 */
 	while (valid_burst_count--) {
-		if (*buff_index > (RX_BUF_SIZE - UART_BURST_SIZE))
+		if (*buff_index >= (RX_BUF_SIZE - UART_BURST_SIZE))
 			break;
 		burst_buf = (u32 *)&rx_buff[*buff_index];
 		*burst_buf = readl(port->membase + UART_RX_BURST_FIFO);
@@ -311,7 +311,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
 	}
 
 	while (*valid_byte_count) {
-		if (*buff_index > RX_BUF_SIZE)
+		if (*buff_index >= RX_BUF_SIZE)
 			break;
 		rx_buff[*buff_index] = readb(port->membase +
 					     UART_RX_BYTE_FIFO);
-- 
2.43.0

Re: [PATCH] serial: 8250_pci1xxxx: off by one in pci1xxxx_process_read_data()

Posted by Hugo Villeneuve 1 year, 11 months ago

On Wed, 10 Jan 2024 21:52:28 +0300
Dan Carpenter <dan.carpenter@linaro.org> wrote:

> These > comparisons should be >= to prevent writing one element beyond
> the end of the rx_buff[] array.  The buffer has RX_BUF_SIZE[] elements.

Hi,
your commit title message is very confusing and doesn't hint that this
is a bug fix (or a potential bug fix)...

Hugo Villeneuve


> 
> Fixes: aba8290f368d ("8250: microchip: pci1xxxx: Add Burst mode reception support in uart driver for writing into FIFO")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> From static analysis, not testing.
> 
>  drivers/tty/serial/8250/8250_pci1xxxx.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/8250_pci1xxxx.c b/drivers/tty/serial/8250/8250_pci1xxxx.c
> index 558c4c7f3104..cd258922bd78 100644
> --- a/drivers/tty/serial/8250/8250_pci1xxxx.c
> +++ b/drivers/tty/serial/8250/8250_pci1xxxx.c
> @@ -302,7 +302,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
>  	 * to read, the data is received one byte at a time.
>  	 */
>  	while (valid_burst_count--) {
> -		if (*buff_index > (RX_BUF_SIZE - UART_BURST_SIZE))
> +		if (*buff_index >= (RX_BUF_SIZE - UART_BURST_SIZE))
>  			break;
>  		burst_buf = (u32 *)&rx_buff[*buff_index];
>  		*burst_buf = readl(port->membase + UART_RX_BURST_FIFO);
> @@ -311,7 +311,7 @@ static void pci1xxxx_process_read_data(struct uart_port *port,
>  	}
>  
>  	while (*valid_byte_count) {
> -		if (*buff_index > RX_BUF_SIZE)
> +		if (*buff_index >= RX_BUF_SIZE)
>  			break;
>  		rx_buff[*buff_index] = readb(port->membase +
>  					     UART_RX_BYTE_FIFO);
> -- 
> 2.43.0
> 
>

Re: [PATCH] serial: 8250_pci1xxxx: off by one in pci1xxxx_process_read_data()

Posted by Dan Carpenter 1 year, 11 months ago

On Wed, Jan 10, 2024 at 02:11:46PM -0500, Hugo Villeneuve wrote:
> On Wed, 10 Jan 2024 21:52:28 +0300
> Dan Carpenter <dan.carpenter@linaro.org> wrote:
> 
> > These > comparisons should be >= to prevent writing one element beyond
> > the end of the rx_buff[] array.  The buffer has RX_BUF_SIZE[] elements.
> 
> Hi,
> your commit title message is very confusing and doesn't hint that this
> is a bug fix (or a potential bug fix)...
> 

Most C programmers know what an "off by one" is...  But sure I can add
"fix" to the subject.  I debated either way, but left it off because the
subject was already too long.

regards,
dan carpenter