From patchwork Mon Mar 19 22:32:19 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Robert Jarzmik X-Patchwork-Id: 147665 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:4978:20e::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 7136CB6FAB for ; Tue, 20 Mar 2012 09:33:34 +1100 (EST) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1S9l85-0008Fw-3M; Mon, 19 Mar 2012 22:32:41 +0000 Received: from smtp6-g21.free.fr ([2a01:e0c:1:1599::15]) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1S9l81-0008E5-W2 for linux-mtd@lists.infradead.org; Mon, 19 Mar 2012 22:32:39 +0000 Received: from beldin.local (unknown [82.243.122.54]) by smtp6-g21.free.fr (Postfix) with ESMTP id D31B682286; Mon, 19 Mar 2012 23:32:32 +0100 (CET) From: Robert Jarzmik To: linux-mtd@lists.infradead.org Subject: [PATCH 1/4] drivers/mtd: docg3 fix inbound calculations Date: Mon, 19 Mar 2012 23:32:19 +0100 Message-Id: <1332196342-21545-2-git-send-email-robert.jarzmik@free.fr> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1332196342-21545-1-git-send-email-robert.jarzmik@free.fr> References: <1332196342-21545-1-git-send-email-robert.jarzmik@free.fr> X-Spam-Note: CRM114 invocation failed X-Spam-Score: -1.9 (-) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-1.9 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (robert.jarzmik[at]free.fr) -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Cc: Robert Jarzmik X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The last erase block was not accessible, as the out of bound check was incorrectly rejecting the last block. The read/write/erase offset checks were forbidding the usage of the last block, because of the calculation which was considering the byte after the last instead of the last byte. Signed-off-by: Robert Jarzmik --- drivers/mtd/devices/docg3.c | 17 +++++------------ 1 files changed, 5 insertions(+), 12 deletions(-) diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index db9a4b7..09d039d 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -872,11 +872,8 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t from, if (ooblen % DOC_LAYOUT_OOB_SIZE) return -EINVAL; - ret = -EINVAL; - calc_block_sector(from + len, &block0, &block1, &page, &ofs, - docg3->reliable); - if (block1 > docg3->max_block) - goto err; + if (from + len > mtd->size) + return -EINVAL; ops->oobretlen = 0; ops->retlen = 0; @@ -1206,7 +1203,7 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *info) calc_block_sector(info->addr + info->len, &block0, &block1, &page, &ofs, docg3->reliable); ret = -EINVAL; - if (block1 > docg3->max_block || page || ofs) + if (info->addr + info->len > mtd->size || page || ofs) goto reset_err; ret = 0; @@ -1442,12 +1439,8 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs, if (len && ooblen && (len / DOC_LAYOUT_PAGE_SIZE) != (ooblen / oobdelta)) return -EINVAL; - - ret = -EINVAL; - calc_block_sector(ofs + len, &block0, &block1, &page, &pofs, - docg3->reliable); - if (block1 > docg3->max_block) - goto err; + if (ofs + len > mtd->size) + return -EINVAL; ops->oobretlen = 0; ops->retlen = 0;