From ed7a85045d0a0688a51bdab9e1a1d6ee79cb33b6 Mon Sep 17 00:00:00 2001 From: Florian Achleitner Date: Wed, 18 Nov 2015 09:04:12 +0100 Subject: [PATCH] sc16is7xx: Fix TX buffer overrun caused by wrong tx fifo level read-out We found that our sc16is7xx on spi reported a TX fifo free space value (TXLVL_REG) of 255 ocassionally, which is obviously wrong, with a 64 byte fifo and caused a buffer overrun and a kernel crash. To trigger this, a large write to the tty is sufficient. The fifo fills, TXLVL_REG reads zero, but the handle_tx function does a zero-data-length write to the TX fifo anyways through sc16is7xx_fifo_write. The next TXLVL_REG read then yields 255, for unknown reasons. A subsequent read is ok. Prevent zero-data-length writes if the TX fifo is full, because they are pointless, and because they trigger wrong TXLVL read-outs. Furthermore, prevent a TX buffer overrun if the peripheral reports values larger than the buffer size and thus, don't allow the peripheral to crash the kernel. Signed-off-by: Florian Achleitner Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/sc16is7xx.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index edb5305b9d4d..5815bcbc55b2 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -389,6 +389,13 @@ static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) const u8 line = sc16is7xx_line(port); u8 addr = (SC16IS7XX_THR_REG << SC16IS7XX_REG_SHIFT) | line; + /* + * Don't send zero-length data, at least on SPI it confuses the chip + * delivering wrong TXLVL data. + */ + if (unlikely(!to_send)) + return; + regcache_cache_bypass(s->regmap, true); regmap_raw_write(s->regmap, addr, s->buf, to_send); regcache_cache_bypass(s->regmap, false); @@ -630,6 +637,12 @@ static void sc16is7xx_handle_tx(struct uart_port *port) if (likely(to_send)) { /* Limit to size of TX FIFO */ txlen = sc16is7xx_port_read(port, SC16IS7XX_TXLVL_REG); + if (txlen > SC16IS7XX_FIFO_SIZE) { + dev_err_ratelimited(port->dev, + "chip reports %d free bytes in TX fifo, but it only has %d", + txlen, SC16IS7XX_FIFO_SIZE); + txlen = 0; + } to_send = (to_send > txlen) ? txlen : to_send; /* Add data to send */