From patchwork Thu Sep 29 22:27:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heinrich Schuchardt X-Patchwork-Id: 1684641 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.a=rsa-sha256 header.s=badeba3b8450 header.b=H1I87Aw4; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Mdnzw2wxjz1yqS for ; Fri, 30 Sep 2022 08:27:38 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 3888D84ABC; Fri, 30 Sep 2022 00:27:22 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.b="H1I87Aw4"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 91EE784AB8; Fri, 30 Sep 2022 00:27:19 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,FREEMAIL_FROM,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 54AA184C4A for ; Fri, 30 Sep 2022 00:27:14 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=xypron.glpk@gmx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1664490433; bh=QeGSXNfgLsJ5FhTHATonkeoJdneeTZQkQ3mfuUi33Ak=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date; b=H1I87Aw4ahpKx+hzZBwmamZR/exrgwd7dFqAcu4mpim3zq/6244DZB89yh9v911S0 m0q/HhuIzwkXPqyNb67cApeh3le3NXLBX9uK/xw73RNgo/I7skQdAfTS9jPHtBUcKx 8/zE/YjL1N3Cn7KSA/klbPiKdI4MRMYBt8HsOc70= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from rpi4.fritz.box ([84.118.157.2]) by mail.gmx.net (mrgmx105 [212.227.17.174]) with ESMTPSA (Nemesis) id 1MUXtY-1omvwn1fNo-00QTgP; Fri, 30 Sep 2022 00:27:13 +0200 From: Heinrich Schuchardt To: Simon Glass Cc: u-boot@lists.denx.de, Heinrich Schuchardt Subject: [PATCH 1/1] regmap: fix range checks Date: Thu, 29 Sep 2022 22:27:06 +0000 Message-Id: <20220929222706.27184-1-xypron.glpk@gmx.de> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Provags-ID: V03:K1:g7/Up3KtwJBVeldqsuGcZX+9ReF5tt5Ry0UtOy0IUWPWUs2uTZ0 jyv6q/zIeXSrD/QegGiTX0St1mHVu2c2rcJDhilfzis75HflPKkkYTgGtu6cGN3qsQNucj4 74aFTkFFVBZ6ogh4Ti30LYRMYIFSJv0NeVQVK1I4x2mC7HegJ8g9FcqRZU83vB/U3tQDjg9 3oRDeDdDZQ5RxXdxoR3iA== X-UI-Out-Filterresults: notjunk:1;V03:K0:/+EbDKfP0R0=:e8A7UhLCbSLAwGdOJlIdcI HRrBIWoabPcHq8NcefBfbYeNQmtvAARMIUO11SOfcjhY4gVVozJX8Pur+fMTcdjBarVSWNcKw mMZCcwUfb6FdVNFwUgMQf3OZP5CToKeVwf78wDjHOoyqOLoQWq1pAJ+46Exkn2FERhknvzjsY DI2K3QDBEYwmuqc7iUgNGKA/+uNY86VTTLYnqKDSZ164hjyCq7dGqcDHF16+aq702sNiyeWsr yycscq2e4byNaQ9P1tXpC8YucpvA4Cj93+p1XxGpeBTQiSgiD6gt8yWIDUcLotG3sV/sHzD1B 3w9n3PEzFA8JHbVUw/LHvvsars3fKIMdI0WrIbltMqobgxmyJ31X43JI7HyiQvLWzcCbxcOsp 3EB7wr5X4bW0aTUT+lXAy1N1bqobtC2nVZfYFqvquXGbRsRhReg+JFczC5MLtpvGYS0bym1rn eAlI4Fz4ftz1TmoCNe67O4jyWOdvFFFuFXHYV+N3y4BKbFPolobDiVIp0SQmqMXizVDwxoELc G8IRozH6U0ZtGPej/YGa+4DXtZwyX2pFCbeaXwj9LLsAQ76pjWcE+Sp+ypSNQLlD71MTzaWjo sSyu2Q5vsyyIbg2mLdqBoP/OPg2LTWdPWprbO5KEey/ckjIJYbJobUjkdMpw7gMyGoSXEAbJD +cPdq1+WlvXgUVfd+sVFrVJhRnErZNAqOlMcLdgFg+jitupLdkMqU0WNjbnYkDbZ0u8m7L/Bh yunhvduRJmmgV7hhWGTGVjv3go7CvyXEFhSX1WEIZUu+njmG2YRraIE+3d+W3vy+kbuLKNWUF zeHzHLmjt3ojrNXU7wq1nNw+0idAUr1ECJ0MUdeRB8EqTpgNqc7l+FdnM6SrIU+j1r4f7+Ae8 pdNC0N8Z1GIfA6FsbSZ4LZn0nn7nlZvdsfylupUanmVUmK11Brjh3KhvvceHCznXh9+jHiQ8l XE/azYXMM2SqOKI5rkGP1DgRRXvRLoXPqAu8OsNiJEqZaJyYEKj2zrc8jolxV/arUSTbNiAzg Jqn78upa2p1eYILDc0B/ydx/mfLuwU3ZG6LSygm/9Z1E71yantvcajhGIIwZJU+xCjgxY/T3D X+TI+X8wywwuSg/TgKvEqtdRrFEmxBGBK46IaVe+ZXWDh9A/bqgMjYanmhmPz6Ytlnd8dJXmZ 8EX71Ko3P+KlDLkUSRipVm2f3W X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean On the 32bit ARM sandbox 'dm ut dm_test_devm_regmap' fails with an abort. This is due to incorrect range checks. On 32-bit systems the size of size_t and int is both 32 bit. The expression (offset + val_len) is bound to overflow if offset == -1. Add an overflow check. Signed-off-by: Heinrich Schuchardt Reviewed-by: Simon Glass --- drivers/core/regmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1 diff --git a/drivers/core/regmap.c b/drivers/core/regmap.c index 5f98f85cfc..5ccbf9abb8 100644 --- a/drivers/core/regmap.c +++ b/drivers/core/regmap.c @@ -399,7 +399,7 @@ int regmap_raw_read_range(struct regmap *map, uint range_num, uint offset, range = &map->ranges[range_num]; offset <<= map->reg_offset_shift; - if (offset + val_len > range->size) { + if (offset + val_len > range->size || offset + val_len < offset) { debug("%s: offset/size combination invalid\n", __func__); return -ERANGE; } @@ -538,7 +538,7 @@ int regmap_raw_write_range(struct regmap *map, uint range_num, uint offset, range = &map->ranges[range_num]; offset <<= map->reg_offset_shift; - if (offset + val_len > range->size) { + if (offset + val_len > range->size || offset + val_len < offset) { debug("%s: offset/size combination invalid\n", __func__); return -ERANGE; }