* [PATCH] [MTD] [NAND] Correctly validate out-of-band offset and length
@ 2007-01-31 15:58 Adrian Hunter
2007-02-09 15:02 ` David Woodhouse
0 siblings, 1 reply; 2+ messages in thread
From: Adrian Hunter @ 2007-01-31 15:58 UTC (permalink / raw)
To: linux-mtd
Add checks to ensure that out-of-band reads and writes are
not attempted with an invalid offset or length. Specifically,
the offset must be less than the size of oob for a page
and the length must not go beyond the size of the device.
Additionally the checks must adjust for auto-placement
(MTD_OOB_AUTO) of oob data.
Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com>
---
drivers/mtd/nand/nand_base.c | 46 +++++++++++++++++++++++++++++++++++++----
1 files changed, 41 insertions(+), 5 deletions(-)
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index dfe56e0..c13d664 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1272,10 +1272,25 @@ static int nand_do_read_oob(struct mtd_i
DEBUG(MTD_DEBUG_LEVEL3, "nand_read_oob: from = 0x%08Lx, len = %i\n",
(unsigned long long)from, readlen);
- if (ops->mode == MTD_OOB_RAW)
- len = mtd->oobsize;
- else
+ if (ops->mode == MTD_OOB_AUTO)
len = chip->ecc.layout->oobavail;
+ else
+ len = mtd->oobsize;
+
+ if (unlikely(ops->ooboffs >= len)) {
+ DEBUG(MTD_DEBUG_LEVEL0, "nand_read_oob: "
+ "Attempt to start read outside oob\n");
+ return -EINVAL;
+ }
+
+ /* Do not allow reads past end of device */
+ if (unlikely(from >= mtd->size ||
+ ops->ooboffs + readlen > ((mtd->size >> chip->page_shift) -
+ (from >> chip->page_shift)) * len)) {
+ DEBUG(MTD_DEBUG_LEVEL0, "nand_read_oob: "
+ "Attempt read beyond end of device\n");
+ return -EINVAL;
+ }
chipnr = (int)(from >> chip->chip_shift);
chip->select_chip(mtd, chipnr);
@@ -1742,19 +1757,40 @@ static int nand_write(struct mtd_info *m
static int nand_do_write_oob(struct mtd_info *mtd, loff_t to,
struct mtd_oob_ops *ops)
{
- int chipnr, page, status;
+ int chipnr, page, status, len;
struct nand_chip *chip = mtd->priv;
DEBUG(MTD_DEBUG_LEVEL3, "nand_write_oob: to = 0x%08x, len = %i\n",
(unsigned int)to, (int)ops->ooblen);
+ if (ops->mode == MTD_OOB_AUTO)
+ len = chip->ecc.layout->oobavail;
+ else
+ len = mtd->oobsize;
+
/* Do not allow write past end of page */
- if ((ops->ooboffs + ops->ooblen) > mtd->oobsize) {
+ if ((ops->ooboffs + ops->ooblen) > len) {
DEBUG(MTD_DEBUG_LEVEL0, "nand_write_oob: "
"Attempt to write past end of page\n");
return -EINVAL;
}
+ if (unlikely(ops->ooboffs >= len)) {
+ DEBUG(MTD_DEBUG_LEVEL0, "nand_read_oob: "
+ "Attempt to start write outside oob\n");
+ return -EINVAL;
+ }
+
+ /* Do not allow reads past end of device */
+ if (unlikely(to >= mtd->size ||
+ ops->ooboffs + ops->ooblen >
+ ((mtd->size >> chip->page_shift) -
+ (to >> chip->page_shift)) * len)) {
+ DEBUG(MTD_DEBUG_LEVEL0, "nand_read_oob: "
+ "Attempt write beyond end of device\n");
+ return -EINVAL;
+ }
+
chipnr = (int)(to >> chip->chip_shift);
chip->select_chip(mtd, chipnr);
--
1.4.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] [MTD] [NAND] Correctly validate out-of-band offset and length
2007-01-31 15:58 [PATCH] [MTD] [NAND] Correctly validate out-of-band offset and length Adrian Hunter
@ 2007-02-09 15:02 ` David Woodhouse
0 siblings, 0 replies; 2+ messages in thread
From: David Woodhouse @ 2007-02-09 15:02 UTC (permalink / raw)
To: Adrian Hunter; +Cc: linux-mtd
On Wed, 2007-01-31 at 17:58 +0200, Adrian Hunter wrote:
> Add checks to ensure that out-of-band reads and writes are
> not attempted with an invalid offset or length. Specifically,
> the offset must be less than the size of oob for a page
> and the length must not go beyond the size of the device.
> Additionally the checks must adjust for auto-placement
> (MTD_OOB_AUTO) of oob data.
>
> Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com>
Applied; thanks.
--
dwmw2
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-02-09 15:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-01-31 15:58 [PATCH] [MTD] [NAND] Correctly validate out-of-band offset and length Adrian Hunter
2007-02-09 15:02 ` David Woodhouse
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.