From patchwork Tue Aug 11 06:15:03 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shunqian Zheng X-Patchwork-Id: 6988731 Return-Path: X-Original-To: patchwork-linux-rockchip@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id DB7509F373 for ; Tue, 11 Aug 2015 06:19:27 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 262EC20604 for ; Tue, 11 Aug 2015 06:19:27 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 416AA20574 for ; Tue, 11 Aug 2015 06:19:26 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZP2uD-0002PJ-Vj; Tue, 11 Aug 2015 06:19:25 +0000 Received: from mail-ig0-f169.google.com ([209.85.213.169]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZP2uC-0002Ku-Ik for linux-rockchip@lists.infradead.org; Tue, 11 Aug 2015 06:19:25 +0000 Received: by igfj19 with SMTP id j19so65348736igf.1 for ; Mon, 10 Aug 2015 23:19:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nbeHeDFepDDbRStm+UytOz/5SCBnkRZYGUxXHhMzIXo=; b=VF6JOI7R7m6e4YsYAVMA/RXj1r2n8jhDSEhqz0kGwxwJtCAlb9DasrF5bWAfdRyRHs vNmmrKVi5z5Ev882xj3sNjPAoBpy8X4QDbd+fq5KJpodUrgNs13FKwtiZfoAbIKNvMpv fWXYOx0YvOdeeanWix8WNaazSnVJtMcjLZE/c1ZMZCGHx2Z5b+aFT0ZZ4R6VO1dl9t2P 14IRyxVqVXQ7Vq1NJJq8yB7pMtLvZ4W5JNCjkrCwu5im29pBmfJWDFt3TyYyc3dYTVji vGwDLYXlzX7DueoF07AYxW5IUoQTsHo7OQDgdS+Ug493RlITnzlkznieqTNcTzIrKPNP 21Hw== X-Received: by 10.50.40.39 with SMTP id u7mr15004481igk.71.1439273943803; Mon, 10 Aug 2015 23:19:03 -0700 (PDT) Received: from SHUNQIAN-W530.example.org ([172.245.164.6]) by smtp.gmail.com with ESMTPSA id t66sm909894ioi.32.2015.08.10.23.18.57 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 10 Aug 2015 23:19:03 -0700 (PDT) From: Shunqian Zheng To: gregkh@linuxfoundation.org, srinivas.kandagatla@linaro.org, maxime.ripard@free-electrons.com, heiko@sntech.de, caesar.wang@rock-chips.com Subject: [PATCH v1 2/5] nvmem: fix the out-of-range leak in read/write() Date: Tue, 11 Aug 2015 14:15:03 +0800 Message-Id: <1439273706-28274-3-git-send-email-zhengsq@rock-chips.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1439273706-28274-1-git-send-email-zhengsq@rock-chips.com> References: <1439273706-28274-1-git-send-email-zhengsq@rock-chips.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150810_231924_665462_09670E6A X-CRM114-Status: GOOD ( 10.09 ) X-Spam-Score: -2.4 (--) X-BeenThere: linux-rockchip@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Upstream kernel work for Rockchip platforms List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-rockchip@lists.infradead.org, xjq@rock-chips.com, ZhengShunQian , dianders@chromium.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Sender: "Linux-rockchip" Errors-To: linux-rockchip-bounces+patchwork-linux-rockchip=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: ZhengShunQian The position to read/write must be less than max register size. Signed-off-by: ZhengShunQian Acked-by: Srinivas Kandagatla --- drivers/nvmem/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index d3c6676..f4af8e5 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -67,7 +67,7 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj, int rc; /* Stop the user from reading */ - if (pos > nvmem->size) + if (pos >= nvmem->size) return 0; if (pos + count > nvmem->size) @@ -92,7 +92,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj, int rc; /* Stop the user from writing */ - if (pos > nvmem->size) + if (pos >= nvmem->size) return 0; if (pos + count > nvmem->size)