summaryrefslogtreecommitdiff
path: root/drivers/tty
diff options
context:
space:
mode:
authorJan Kundrát <jan.kundrat@cesnet.cz>2019-08-28 20:56:26 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-09-04 13:43:55 +0300
commit8016c3da0cc263f257e802fae36482eaad2d04fa (patch)
tree03caa785fd706ffdc35684198a95f03680861a75 /drivers/tty
parent06e9b2fe7f1279bea649002cc40cce54a383f052 (diff)
downloadlinux-8016c3da0cc263f257e802fae36482eaad2d04fa.tar.xz
tty: max310x: fix off-by-one buffer access when storing overrun
A recent change split the insertion loop into two parts. The first part accessed bytes 0, 1, ... (rxlen - 2), and the second part by mistake took offset `rxlen` instead of the correct `rxlen - 1`. So one byte was not stored, and the final access wrote past the end of the rx_buf. Fixes: 9c12d739d69b (tty: max310x: Split uart characters insertion loop) Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz> Reviewed-by: Serge Semin <fancer.lancer@gmail.com> Link: https://lore.kernel.org/r/13ea227620aaad8a7231d42ed03a8508297d4eb3.1567027079.git.jan.kundrat@cesnet.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty')
-rw-r--r--drivers/tty/serial/max310x.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index e6c48a99bd85..0e0c2740ec7e 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -689,7 +689,7 @@ static void max310x_handle_rx(struct uart_port *port, unsigned int rxlen)
* tail.
*/
uart_insert_char(port, sts, MAX310X_LSR_RXOVR_BIT,
- one->rx_buf[rxlen], flag);
+ one->rx_buf[rxlen-1], flag);
} else {
if (unlikely(rxlen >= port->fifosize)) {