From patchwork Fri Nov 24 06:47:50 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiner Kallweit X-Patchwork-Id: 840963 X-Patchwork-Delegate: bartekgola@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=linux-i2c-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="mInjeNAM"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3yjmwZ369yz9sPs for ; Fri, 24 Nov 2017 17:47:58 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751542AbdKXGr5 (ORCPT ); Fri, 24 Nov 2017 01:47:57 -0500 Received: from mail-wm0-f65.google.com ([74.125.82.65]:34459 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751521AbdKXGr5 (ORCPT ); Fri, 24 Nov 2017 01:47:57 -0500 Received: by mail-wm0-f65.google.com with SMTP id y82so19258486wmg.1 for ; Thu, 23 Nov 2017 22:47:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:subject:to:cc:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=OtZ3RuYt/RpWT0mOMER5q9uc07MRAo8e7CV7qTZZn1Q=; b=mInjeNAMq/HS8E5A29kcDlN/7G25fH1TaciEJ/LkwBIxbShTeAaRImf6Z1PnG+XO+m 7p9wNFAYeG6+Wwuq/nHqR4jQnL7VPHjsudFx3beMUYwuWcORM9c5Dz5IINsoZ9fgTxuG cQdnjwpsS1OGivMnssjhczRVr9uJtFlm+uZTdivbmhn8AEhLn1y6Ap9V1yS5xKpZixvg Z6z9VDOlAzPO0CeCthYv4NhWnIqWII2FxeczZEQZaQJR2md3JBg8Se7pOaCYXJ8hK2Ns Bm2r2PK8xg1bTrSEr9XVKDZGZ0pkOAM9mmLvmQoOvzSzCtiwpSZ+NLNmqTA1m43H6g99 B30w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:subject:to:cc:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=OtZ3RuYt/RpWT0mOMER5q9uc07MRAo8e7CV7qTZZn1Q=; b=IGIRixDUAxHLhhySsUzA87dPr45PfrP8Ni71qhLaim7W6XuPzmOSLTqeA2/2ZBz0Ol LuWgGcouXn+n6KVPyJcd2WgKvVVGR3htmOpcBaOp2E6DMwz4CHuyaCaotHBt8meuQNq8 8cGj3jJS1rO4wj4w2hbhZQJXoLIrv2dDXO5AvN7GBEippCN30rGStz8hJFsViJ14m8Ua ygPx+zBRx282rpW626QdrfG6euTrv/l/yLvfVVSPNgLind6vrg0xGr1l+5CoEuMC+oVQ 98xjzYs3RucPRZnwEbWM/2e58j0XeAxHSKXCOz5H8QbgaMDhsneHhSbbU07n1iqP9mUR mjrQ== X-Gm-Message-State: AJaThX4KAe39wekgAy66zWiWFYGgMDZTXkiC12k95AVZVW3tV2eBWs2d ZiOrp/CELJ96IEBPuaHrKVax4g== X-Google-Smtp-Source: AGs4zMa5CWgnMU4z/rDafKVVAQsKfDoiPNLkKwa9ENnrWCdbFOwAi4x20hQgkHiWjPBJMkS3m2UQjw== X-Received: by 10.80.157.141 with SMTP id w13mr39781889ede.151.1511506075748; Thu, 23 Nov 2017 22:47:55 -0800 (PST) Received: from ?IPv6:2003:ea:8bc0:e400:95c6:c9e9:4056:3e51? (p200300EA8BC0E40095C6C9E940563E51.dip0.t-ipconnect.de. [2003:ea:8bc0:e400:95c6:c9e9:4056:3e51]) by smtp.googlemail.com with ESMTPSA id x5sm11228068eda.8.2017.11.23.22.47.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Nov 2017 22:47:55 -0800 (PST) From: Heiner Kallweit Subject: [PATCH] eeprom: at24: check at24_read/write arguments To: Bartosz Golaszewski Cc: "linux-i2c@vger.kernel.org" Message-ID: Date: Fri, 24 Nov 2017 07:47:50 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 Sender: linux-i2c-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-i2c@vger.kernel.org So far we completely rely on the caller to provide valid arguments. To be on the safe side perform an own sanity check. Signed-off-by: Heiner Kallweit --- drivers/misc/eeprom/at24.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 00d602be7..52cbaeb6f 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -569,6 +569,9 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count) if (unlikely(!count)) return count; + if (off + count > at24->chip.byte_len) + return -EINVAL; + client = at24_translate_offset(at24, &off); ret = pm_runtime_get_sync(&client->dev); @@ -614,6 +617,9 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count) if (unlikely(!count)) return -EINVAL; + if (off + count > at24->chip.byte_len) + return -EINVAL; + client = at24_translate_offset(at24, &off); ret = pm_runtime_get_sync(&client->dev);