Commit 610009dbf3c7209602d8ae613f4448fc30a80a41
2014-05-10T02:44:18
minion - restrict nonce read result size to ioctl() limit
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39
diff --git a/driver-minion.c b/driver-minion.c
index d4fde64..cc39908 100644
--- a/driver-minion.c
+++ b/driver-minion.c
@@ -293,6 +293,12 @@ struct minion_result {
#define MINION_RES_DATA_SIZ sizeof(struct minion_result)
+/*
+ * (MINION_SPI_BUFSIZ - HSIZE()) / MINION_RES_DATA_SIZ
+ * less a little bit to round it out
+ */
+#define MINION_MAX_RES 120
+
#define MIDSTATE_BYTES 32
#define MERKLE7_OFFSET 64
#define MERKLE_BYTES 12
@@ -2005,12 +2011,19 @@ static void *minion_spi_reply(void *userdata)
* (except at startup) so the answer is always valid
* i.e. there could be more, but never less
*/
- if (res > 0) {
+ uint8_t left = res;
+ while (left > 0) {
+ res = left;
+ if (res > MINION_MAX_RES)
+ res = MINION_MAX_RES;
+ left -= res;
res_task.chip = chip;
res_task.reply = 0;
res_task.rsiz = res * MINION_RES_DATA_SIZ;
minion_txrx(&res_task);
- if (res_task.reply > 0) {
+ if (res_task.reply <= 0)
+ break;
+ else {
if (res_task.reply < (int)MINION_RES_DATA_SIZ) {
char *buf = bin2hex((unsigned char *)(&(res_task.rbuf[res_task.osiz - res_task.rsiz])), (int)(res_task.rsiz));
applog(LOG_ERR, "%s%i: Bad work reply (%s) size %d, should be at least %d",