From patchwork Wed Mar 4 14:09:36 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: roel kluin X-Patchwork-Id: 24042 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id D0F31DE0AC for ; Thu, 5 Mar 2009 01:11:08 +1100 (EST) Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1Lern5-0006qG-Fw; Wed, 04 Mar 2009 14:09:43 +0000 Received: from mail-ew0-f172.google.com ([209.85.219.172]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1Lern1-0006q1-HW for linux-mtd@lists.infradead.org; Wed, 04 Mar 2009 14:09:42 +0000 Received: by ewy20 with SMTP id 20so3059442ewy.18 for ; Wed, 04 Mar 2009 06:09:37 -0800 (PST) Received: by 10.216.55.201 with SMTP id k51mr662185wec.184.1236175777588; Wed, 04 Mar 2009 06:09:37 -0800 (PST) Received: from ?192.168.1.115? (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 32sm3427928nfu.18.2009.03.04.06.09.37 (version=TLSv1/SSLv3 cipher=RC4-MD5); Wed, 04 Mar 2009 06:09:37 -0800 (PST) Message-ID: <49AE8BA0.7060903@gmail.com> Date: Wed, 04 Mar 2009 15:09:36 +0100 From: Roel Kluin User-Agent: Thunderbird 2.0.0.18 (X11/20081105) MIME-Version: 1.0 To: kyungmin.park@samsung.com Subject: [PATCH] onenand: test before subtraction on unsigned X-Spam-Score: 0.0 (/) Cc: Andrew Morton , linux-mtd@lists.infradead.org X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org len is unsigned so will wrap around when sizeof(struct otp_info) is greater than len. Signed-off-by: Roel Kluin diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c index 529af27..7c2ebe9 100644 --- a/drivers/mtd/onenand/onenand_base.c +++ b/drivers/mtd/onenand/onenand_base.c @@ -2296,11 +2296,12 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len, if (!action) { /* OTP Info functions */ struct otp_info *otpinfo; - len -= sizeof(struct otp_info); - if (len <= 0) { + if (len <= sizeof(struct otp_info)) { + len = 0; ret = -ENOSPC; break; } + len -= sizeof(struct otp_info); otpinfo = (struct otp_info *) buf; otpinfo->start = from;