linux-stable.git/drivers/char/mwave, branch linux-4.9.y

char/mwave: Adjust io port register size

2022-01-27T07:47:35+00:00

[ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ]

Using MKWORD() on a byte-sized variable results in OOB read. Expand the
size of the reserved area so both MKWORD and MKBYTE continue to work
without overflow. Silences this warning on a -Warray-bounds build:

drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned int[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werror=array-bounds]
  346 | #define MKWORD(var) (*((unsigned short *)(&var)))
      |                     ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp'
  356 | #define OutWordDsp(index,value)   outw(value,usDspBaseIO+index)
      |                                        ^~~~~
drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD'
  373 |         OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl));
      |                                         ^~~~~~
drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl'
  358 |         DSP_ISA_SLAVE_CONTROL rSlaveControl;
      |                               ^~~~~~~~~~~~~

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

char/mwave: fix potential Spectre v1 vulnerability

2019-01-31T07:12:34+00:00

commit 701956d4018e5d5438570e39e8bda47edd32c489 upstream.

ipcnum is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/char/mwave/mwavedd.c:299 mwave_ioctl() warn: potential spectre issue 'pDrvData->IPCs' [w] (local cap)

Fix this by sanitizing ipcnum before using it to index pDrvData->IPCs.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Greg Kroah-Hartman

char/mwave: remove custom BOOLEAN type

2016-08-31T12:22:49+00:00

The mwave driver has its own macros for the BOOLEAN type and the
TRUE/FALSE values. This is redundant because the kernel already
has bool/true/false, and it clashes with the ACPI headers that
also define these types. The linux/acpi.h header is now included
implicitly from mwave through the mc146818rtc.h header, as
reported by Stephen Rothwell:

In file included from drivers/char/mwave/smapi.c:51:0:
drivers/char/mwave/smapi.h:52:0: warning: "TRUE" redefined
 #define TRUE 1
 ^
In file included from include/acpi/acpi.h:58:0,
                 from include/linux/acpi.h:33,
                 from include/linux/mc146818rtc.h:21,
                 from drivers/char/mwave/smapi.c:50:
include/acpi/actypes.h:438:0: note: this is the location of the previous definition
 #define TRUE                            (1 == 1)
 ^

This removes the private types from mwave and uses the standard
types instead.

Signed-off-by: Arnd Bergmann 
Reviewed-by: Alexandre Belloni 
Fixes: fd09cc80165c ("rtc: cmos: move mc146818rtc code out of asm-generic/rtc.h")
Signed-off-by: Greg Kroah-Hartman

drivers/char: delete non-required instances of include

2014-02-07T23:10:19+00:00

None of these files are actually using any __init type directives
and hence don't need to include .  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.

Cc: David Airlie 
Cc: Matt Mackall 
Cc: Herbert Xu 
Cc: Kukjin Kim 
Cc: Corey Minyard 
Cc: Chris Metcalf 
Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Cc: Peter Huewe 
Cc: Ashley Lai 
Cc: Marcel Selhorst 
Signed-off-by: Paul Gortmaker 
Signed-off-by: Greg Kroah-Hartman

mwave: fix info leak in mwave_ioctl()

2013-07-09T17:33:28+00:00

Smatch complains that on 64 bit systems, there is a hole in the
MW_ABILITIES struct between ->component_count and ->component_list[].
It leaks stack information from the mwave_ioctl() function.

I've added a memset() to initialize the struct to zero.

Signed-off-by: Dan Carpenter 
Cc: Greg KH 
Cc: Jiri Kosina 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

8250: three way resolve of the 8250 diffs

2012-07-17T16:11:50+00:00

This resolves the differences between the original 8250 patch, the revised 8250 patch
and the independant clean up of the octeon driver (to use platform devices properly yay!)

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

Remove all #inclusions of asm/system.h

2012-03-28T17:30:03+00:00

Remove all #inclusions of asm/system.h preparatory to splitting and killing
it.  Performed with the following command:

perl -p -i -e 's!^#\s*include\s*.*\n!!' `grep -Irl '^#\s*include\s*' *`

Signed-off-by: David Howells

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi

char: change to new flag variable

2011-03-17T13:02:59+00:00

Replace EXTRA_CFLAGS with ccflags-y.

Signed-off-by: matt mooney 
Acked-by: WANG Cong 
Signed-off-by: Michal Marek

drivers/char/mwave/Makefile: clean up

2010-10-28T01:03:15+00:00

Changed -objs to -y in Makefile and use
ccflags-y option.

Signed-off-by: Tracey Dent 
Cc: Jiri Slaby 
Cc: Michal Marek 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds