sc16is7xx: Fix TX buffer overrun caused by wrong tx fifo level read-out
authorFlorian Achleitner <achleitner.florian@fronius.com>
Wed, 18 Nov 2015 08:04:12 +0000 (09:04 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 14 Dec 2015 03:59:48 +0000 (19:59 -0800)
commited7a85045d0a0688a51bdab9e1a1d6ee79cb33b6
tree19c03da356744ef5f10ed6612fa9cbfe6192bfc9
parent63d8cb3f19dabb409a09b4f2b8827934ab9365a3
sc16is7xx: Fix TX buffer overrun caused by wrong tx fifo level read-out

We found that our sc16is7xx on spi reported a TX fifo free space value
(TXLVL_REG) of 255 ocassionally, which is obviously wrong, with a
64 byte fifo and caused a buffer overrun and a kernel crash.

To trigger this, a large write to the tty is sufficient. The fifo fills,
TXLVL_REG reads zero, but the handle_tx function does a zero-data-length
write to the TX fifo anyways through sc16is7xx_fifo_write. The next
TXLVL_REG read then yields 255, for unknown reasons. A subsequent read
is ok.

Prevent zero-data-length writes if the TX fifo is full, because they are
pointless, and because they trigger wrong TXLVL read-outs.

Furthermore, prevent a TX buffer overrun if the peripheral reports values
larger than the buffer size and thus, don't allow the peripheral to crash
the kernel.

Signed-off-by: Florian Achleitner <achleitner.florian@fronius.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/serial/sc16is7xx.c