From patchwork Wed Sep 16 19:40:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Evgeny Novikov X-Patchwork-Id: 11780659 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 32FBA6CA for ; Wed, 16 Sep 2020 19:42:48 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id EBEB1208E4 for ; Wed, 16 Sep 2020 19:42:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="QX77BgpS" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EBEB1208E4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=ispras.ru Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=q+/W8z8GNccO2UvNfPxc1KFcp4/1um/0IjFhBTdwfQg=; b=QX77BgpSYnDHgl8Vml2QFlE4lJ 4YPjrfIuq3tqizLEXXxlGWGXXmeB6E2hgBo0A3VTdZX39eE1dlk0lDBS9z1OvGz4LAJ9x1p5BwFxs TU0nxaAtLMK8PDbCvk3/mL9f5cZ1NLkw6mr7pWdAU99qjK3z6LvGzTF8CVC2+UJl68u+q3Qf0YRlw zugVhB9b1h5/2b+0LeTPSO/LRWXICA+QSXmIr1Zgc1Kao5tZU04ce8dUCEp/eG8Z/PmQ6NvBzBgJd gJzcrxPmnj4XKzWv7y1u9u8+YePBZ/iDnestdECUQeafyfa2z8fNsBTZvvpEwtO8uTewNvefPRAxN jlXzdktw==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kIdIs-0002XK-F3; Wed, 16 Sep 2020 19:41:18 +0000 Received: from mail.ispras.ru ([83.149.199.84]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kIdIp-0002WB-9q; Wed, 16 Sep 2020 19:41:16 +0000 Received: from hellwig.intra.ispras.ru (unknown [10.10.2.182]) by mail.ispras.ru (Postfix) with ESMTPS id 0F47A40D403E; Wed, 16 Sep 2020 19:41:10 +0000 (UTC) From: Evgeny Novikov To: Miquel Raynal Subject: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init() Date: Wed, 16 Sep 2020 22:40:45 +0300 Message-Id: <20200916194045.6378-1-novikov@ispras.ru> X-Mailer: git-send-email 2.16.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200916_154115_480066_7AE2DEA1 X-CRM114-Status: GOOD ( 11.79 ) X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: ldv-project@linuxtesting.org, Vignesh Raghavendra , "Gustavo A. R. Silva" , Evgeny Novikov , Richard Weinberger , linux-kernel@vger.kernel.org, Stephen Boyd , Masahiro Yamada , Boris Brezillon , linux-mtd@lists.infradead.org, Matthias Brugger , linux-mediatek@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org If of_get_property() will set nsels to negative values the driver may allocate insufficient memory for chip. Moreover, there may be underflow for devm_kzalloc(). This can result in various bad consequences later. The patch causes mtk_nfc_nand_chip_init() to fail for negative values of nsels. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov --- drivers/mtd/nand/raw/mtk_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c index ad1b55dab211..df98a2eec240 100644 --- a/drivers/mtd/nand/raw/mtk_nand.c +++ b/drivers/mtd/nand/raw/mtk_nand.c @@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc, return -ENODEV; nsels /= sizeof(u32); - if (!nsels || nsels > MTK_NAND_MAX_NSELS) { + if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) { dev_err(dev, "invalid reg property size %d\n", nsels); return -EINVAL; }