From patchwork Fri Dec 7 11:27:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Biju Das X-Patchwork-Id: 10718007 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CDC61109C for ; Fri, 7 Dec 2018 11:36:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BD7B22BDD4 for ; Fri, 7 Dec 2018 11:36:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B16252E12D; Fri, 7 Dec 2018 11:36:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5895E2BDD4 for ; Fri, 7 Dec 2018 11:36:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725998AbeLGLg2 (ORCPT ); Fri, 7 Dec 2018 06:36:28 -0500 Received: from relmlor2.renesas.com ([210.160.252.172]:5386 "EHLO relmlie6.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725988AbeLGLg2 (ORCPT ); Fri, 7 Dec 2018 06:36:28 -0500 X-IronPort-AV: E=Sophos;i="5.56,326,1539615600"; d="scan'208";a="2022461" Received: from unknown (HELO relmlir5.idc.renesas.com) ([10.200.68.151]) by relmlie6.idc.renesas.com with ESMTP; 07 Dec 2018 20:36:26 +0900 Received: from be1yocto.ree.adwin.renesas.com (unknown [172.29.43.62]) by relmlir5.idc.renesas.com (Postfix) with ESMTP id E99434045600; Fri, 7 Dec 2018 20:36:23 +0900 (JST) From: Biju Das To: Srinivas Kandagatla , Geert Uytterhoeven , Alexandre Belloni Cc: Biju Das , Simon Horman , Chris Paterson , Fabrizio Castro , Alessandro Zummo , linux-rtc@vger.kernel.org, linux-renesas-soc@vger.kernel.org Subject: [PATCH v4 1/5] nvmem: check invalid number of bytes in nvmem_device_{read,write} Date: Fri, 7 Dec 2018 11:27:42 +0000 Message-Id: <1544182066-31528-2-git-send-email-biju.das@bp.renesas.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1544182066-31528-1-git-send-email-biju.das@bp.renesas.com> References: <1544182066-31528-1-git-send-email-biju.das@bp.renesas.com> Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Add check in nvmem_device_{read,write}()to ensure that nvmem core never passes an invalid number of bytes. Signed-off-by: Biju Das --- V3-->V4 * New patch. --- drivers/nvmem/core.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index d9fd110..db7de33 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1433,10 +1433,21 @@ int nvmem_device_read(struct nvmem_device *nvmem, size_t bytes, void *buf) { int rc; + size_t new_bytes; if (!nvmem) return -EINVAL; + /* Stop the user from reading */ + if ((offset >= nvmem->size) || (bytes == 0)) + return 0; + + if (unlikely(check_add_overflow(bytes, offset, &new_bytes))) + return -EOVERFLOW; + + if (new_bytes > nvmem->size) + bytes = nvmem->size - offset; + rc = nvmem_reg_read(nvmem, offset, buf, bytes); if (rc) @@ -1461,16 +1472,29 @@ int nvmem_device_write(struct nvmem_device *nvmem, size_t bytes, void *buf) { int rc; + size_t new_bytes; if (!nvmem) return -EINVAL; + /* Stop the user from writing */ + if (offset >= nvmem->size) + return -ENOSPC; + + if (bytes == 0) + return 0; + + if (unlikely(check_add_overflow(bytes, offset, &new_bytes))) + return -EOVERFLOW; + + if (new_bytes > nvmem->size) + bytes = nvmem->size - offset; + rc = nvmem_reg_write(nvmem, offset, buf, bytes); if (rc) return rc; - return bytes; } EXPORT_SYMBOL_GPL(nvmem_device_write);