From patchwork Fri Dec 7 11:27:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Biju Das X-Patchwork-Id: 1009373 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=linux-rtc-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=bp.renesas.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43B9R02pPKz9s55 for ; Fri, 7 Dec 2018 22:36:28 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725999AbeLGLg2 (ORCPT ); Fri, 7 Dec 2018 06:36:28 -0500 Received: from relmlor2.renesas.com ([210.160.252.172]:5386 "EHLO relmlie6.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725988AbeLGLg2 (ORCPT ); Fri, 7 Dec 2018 06:36:28 -0500 X-IronPort-AV: E=Sophos;i="5.56,326,1539615600"; d="scan'208";a="2022461" Received: from unknown (HELO relmlir5.idc.renesas.com) ([10.200.68.151]) by relmlie6.idc.renesas.com with ESMTP; 07 Dec 2018 20:36:26 +0900 Received: from be1yocto.ree.adwin.renesas.com (unknown [172.29.43.62]) by relmlir5.idc.renesas.com (Postfix) with ESMTP id E99434045600; Fri, 7 Dec 2018 20:36:23 +0900 (JST) From: Biju Das To: Srinivas Kandagatla , Geert Uytterhoeven , Alexandre Belloni Cc: Biju Das , Simon Horman , Chris Paterson , Fabrizio Castro , Alessandro Zummo , linux-rtc@vger.kernel.org, linux-renesas-soc@vger.kernel.org Subject: [PATCH v4 1/5] nvmem: check invalid number of bytes in nvmem_device_{read, write} Date: Fri, 7 Dec 2018 11:27:42 +0000 Message-Id: <1544182066-31528-2-git-send-email-biju.das@bp.renesas.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1544182066-31528-1-git-send-email-biju.das@bp.renesas.com> References: <1544182066-31528-1-git-send-email-biju.das@bp.renesas.com> Sender: linux-rtc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rtc@vger.kernel.org Add check in nvmem_device_{read,write}()to ensure that nvmem core never passes an invalid number of bytes. Signed-off-by: Biju Das --- V3-->V4 * New patch. --- drivers/nvmem/core.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index d9fd110..db7de33 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1433,10 +1433,21 @@ int nvmem_device_read(struct nvmem_device *nvmem, size_t bytes, void *buf) { int rc; + size_t new_bytes; if (!nvmem) return -EINVAL; + /* Stop the user from reading */ + if ((offset >= nvmem->size) || (bytes == 0)) + return 0; + + if (unlikely(check_add_overflow(bytes, offset, &new_bytes))) + return -EOVERFLOW; + + if (new_bytes > nvmem->size) + bytes = nvmem->size - offset; + rc = nvmem_reg_read(nvmem, offset, buf, bytes); if (rc) @@ -1461,16 +1472,29 @@ int nvmem_device_write(struct nvmem_device *nvmem, size_t bytes, void *buf) { int rc; + size_t new_bytes; if (!nvmem) return -EINVAL; + /* Stop the user from writing */ + if (offset >= nvmem->size) + return -ENOSPC; + + if (bytes == 0) + return 0; + + if (unlikely(check_add_overflow(bytes, offset, &new_bytes))) + return -EOVERFLOW; + + if (new_bytes > nvmem->size) + bytes = nvmem->size - offset; + rc = nvmem_reg_write(nvmem, offset, buf, bytes); if (rc) return rc; - return bytes; } EXPORT_SYMBOL_GPL(nvmem_device_write);