From patchwork Mon Aug 10 03:22:41 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shunqian Zheng X-Patchwork-Id: 6979231 Return-Path: X-Original-To: patchwork-linux-rockchip@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id BCEFE9F6E5 for ; Mon, 10 Aug 2015 03:23:27 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 0B3B1203A9 for ; Mon, 10 Aug 2015 03:23:27 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 01B93205F1 for ; Mon, 10 Aug 2015 03:23:25 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZOdgL-0003jI-MH; Mon, 10 Aug 2015 03:23:25 +0000 Received: from mail-qg0-f41.google.com ([209.85.192.41]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZOdgJ-0003c0-4S for linux-rockchip@lists.infradead.org; Mon, 10 Aug 2015 03:23:24 +0000 Received: by qgj62 with SMTP id 62so84588017qgj.2 for ; Sun, 09 Aug 2015 20:23:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=waptolGRzWe4eOgSQaufsixvyY1sLB/37uQ3oDqcZCA=; b=kAfNu6kmc6f0O8KypgmVNkhh+mk47Vn54TlnXn3Hi3vt+Y+SmMVopgRO0sRX/lnuKF CUVpkOm7/DYynTLM2UN06n7Ozg9PfQHnpw6B1AdXlkxLXM+KpbiTdsmY5O4Xz7yhHWmK gzt4/ZuVJKQnDncH8ZFv2FeqEhYefZQiX0jAOy6bI9JM2DdvKvaCLVF1n5HP2mMhyQSg Z1GXdXj2TSJrcmBC1gIzBtFpmMTzZhqEfUuAprA7eRE7DmvH7vN8GngeEMzUuKnQDAnC HBeByLGCBVW00YCX7B3eRTyCgZngTgmSS2ZVcIVzUI3MslDFM4gqVlFw/1hnve8MPuwZ sXFw== X-Received: by 10.140.151.214 with SMTP id 205mr5884133qhx.91.1439176981990; Sun, 09 Aug 2015 20:23:01 -0700 (PDT) Received: from SHUNQIAN-W530.example.org ([172.245.48.13]) by smtp.gmail.com with ESMTPSA id 145sm8734937qhy.6.2015.08.09.20.22.57 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 09 Aug 2015 20:23:01 -0700 (PDT) From: Shunqian Zheng To: srinivas.kandagatla@linaro.org, maxime.ripard@free-electrons.com, heiko@sntech.de, linux-kernel@vger.kernel.org, caesar.wang@rock-chips.com Subject: [PATCH 1/3] nvmem: fix the out-of-range leak in read/write() Date: Mon, 10 Aug 2015 11:22:41 +0800 Message-Id: <1439176963-8969-2-git-send-email-zhengsq@rock-chips.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1439176963-8969-1-git-send-email-zhengsq@rock-chips.com> References: <1439176963-8969-1-git-send-email-zhengsq@rock-chips.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150809_202323_255380_A9C871F5 X-CRM114-Status: GOOD ( 10.59 ) X-Spam-Score: -2.4 (--) X-BeenThere: linux-rockchip@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Upstream kernel work for Rockchip platforms List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-rockchip@lists.infradead.org, xjq@rock-chips.com, ZhengShunQian , dianders@chromium.org MIME-Version: 1.0 Sender: "Linux-rockchip" Errors-To: linux-rockchip-bounces+patchwork-linux-rockchip=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: ZhengShunQian The position to read/write must be less than max register size. Signed-off-by: ZhengShunQian Acked-by: Srinivas Kandagatla --- drivers/nvmem/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index d3c6676..f4af8e5 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -67,7 +67,7 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj, int rc; /* Stop the user from reading */ - if (pos > nvmem->size) + if (pos >= nvmem->size) return 0; if (pos + count > nvmem->size) @@ -92,7 +92,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj, int rc; /* Stop the user from writing */ - if (pos > nvmem->size) + if (pos >= nvmem->size) return 0; if (pos + count > nvmem->size)