From: Evgeny Novikov <novikov@ispras.ru>
To: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Evgeny Novikov <novikov@ispras.ru>,
Richard Weinberger <richard@nod.at>,
Vignesh Raghavendra <vigneshr@ti.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
Boris Brezillon <boris.brezillon@collabora.com>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Masahiro Yamada <yamada.masahiro@socionext.com>,
Stephen Boyd <swboyd@chromium.org>,
linux-mtd@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org,
ldv-project@linuxtesting.org
Subject: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Wed, 16 Sep 2020 22:40:45 +0300 [thread overview]
Message-ID: <20200916194045.6378-1-novikov@ispras.ru> (raw)
If of_get_property() will set nsels to negative values the driver may
allocate insufficient memory for chip. Moreover, there may be underflow
for devm_kzalloc(). This can result in various bad consequences later.
The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
nsels.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
---
drivers/mtd/nand/raw/mtk_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
index ad1b55dab211..df98a2eec240 100644
--- a/drivers/mtd/nand/raw/mtk_nand.c
+++ b/drivers/mtd/nand/raw/mtk_nand.c
@@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
return -ENODEV;
nsels /= sizeof(u32);
- if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
+ if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
dev_err(dev, "invalid reg property size %d\n", nsels);
return -EINVAL;
}
--
2.26.2
WARNING: multiple messages have this Message-ID (diff)
From: Evgeny Novikov <novikov@ispras.ru>
To: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: ldv-project@linuxtesting.org,
Vignesh Raghavendra <vigneshr@ti.com>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Evgeny Novikov <novikov@ispras.ru>,
Richard Weinberger <richard@nod.at>,
linux-kernel@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>,
Masahiro Yamada <yamada.masahiro@socionext.com>,
Boris Brezillon <boris.brezillon@collabora.com>,
linux-mtd@lists.infradead.org,
Matthias Brugger <matthias.bgg@gmail.com>,
linux-mediatek@lists.infradead.org,
linux-arm-kernel@lists.infradead.org
Subject: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Wed, 16 Sep 2020 22:40:45 +0300 [thread overview]
Message-ID: <20200916194045.6378-1-novikov@ispras.ru> (raw)
If of_get_property() will set nsels to negative values the driver may
allocate insufficient memory for chip. Moreover, there may be underflow
for devm_kzalloc(). This can result in various bad consequences later.
The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
nsels.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
---
drivers/mtd/nand/raw/mtk_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
index ad1b55dab211..df98a2eec240 100644
--- a/drivers/mtd/nand/raw/mtk_nand.c
+++ b/drivers/mtd/nand/raw/mtk_nand.c
@@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
return -ENODEV;
nsels /= sizeof(u32);
- if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
+ if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
dev_err(dev, "invalid reg property size %d\n", nsels);
return -EINVAL;
}
--
2.26.2
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
WARNING: multiple messages have this Message-ID (diff)
From: Evgeny Novikov <novikov@ispras.ru>
To: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: ldv-project@linuxtesting.org,
Vignesh Raghavendra <vigneshr@ti.com>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Evgeny Novikov <novikov@ispras.ru>,
Richard Weinberger <richard@nod.at>,
linux-kernel@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>,
Masahiro Yamada <yamada.masahiro@socionext.com>,
Boris Brezillon <boris.brezillon@collabora.com>,
linux-mtd@lists.infradead.org,
Matthias Brugger <matthias.bgg@gmail.com>,
linux-mediatek@lists.infradead.org,
linux-arm-kernel@lists.infradead.org
Subject: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Wed, 16 Sep 2020 22:40:45 +0300 [thread overview]
Message-ID: <20200916194045.6378-1-novikov@ispras.ru> (raw)
If of_get_property() will set nsels to negative values the driver may
allocate insufficient memory for chip. Moreover, there may be underflow
for devm_kzalloc(). This can result in various bad consequences later.
The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
nsels.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
---
drivers/mtd/nand/raw/mtk_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
index ad1b55dab211..df98a2eec240 100644
--- a/drivers/mtd/nand/raw/mtk_nand.c
+++ b/drivers/mtd/nand/raw/mtk_nand.c
@@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
return -ENODEV;
nsels /= sizeof(u32);
- if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
+ if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
dev_err(dev, "invalid reg property size %d\n", nsels);
return -EINVAL;
}
--
2.26.2
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
WARNING: multiple messages have this Message-ID (diff)
From: Evgeny Novikov <novikov@ispras.ru>
To: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: ldv-project@linuxtesting.org,
Vignesh Raghavendra <vigneshr@ti.com>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Evgeny Novikov <novikov@ispras.ru>,
Richard Weinberger <richard@nod.at>,
linux-kernel@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>,
Masahiro Yamada <yamada.masahiro@socionext.com>,
Boris Brezillon <boris.brezillon@collabora.com>,
linux-mtd@lists.infradead.org,
Matthias Brugger <matthias.bgg@gmail.com>,
linux-mediatek@lists.infradead.org,
linux-arm-kernel@lists.infradead.org
Subject: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Wed, 16 Sep 2020 22:40:45 +0300 [thread overview]
Message-ID: <20200916194045.6378-1-novikov@ispras.ru> (raw)
If of_get_property() will set nsels to negative values the driver may
allocate insufficient memory for chip. Moreover, there may be underflow
for devm_kzalloc(). This can result in various bad consequences later.
The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
nsels.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
---
drivers/mtd/nand/raw/mtk_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
index ad1b55dab211..df98a2eec240 100644
--- a/drivers/mtd/nand/raw/mtk_nand.c
+++ b/drivers/mtd/nand/raw/mtk_nand.c
@@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
return -ENODEV;
nsels /= sizeof(u32);
- if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
+ if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
dev_err(dev, "invalid reg property size %d\n", nsels);
return -EINVAL;
}
--
2.26.2
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2020-09-16 19:42 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-16 19:40 Evgeny Novikov [this message]
2020-09-16 19:40 ` [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init() Evgeny Novikov
2020-09-16 19:40 ` Evgeny Novikov
2020-09-16 19:40 ` Evgeny Novikov
2020-09-17 16:30 ` Miquel Raynal
2020-09-17 16:30 ` Miquel Raynal
2020-09-17 16:30 ` Miquel Raynal
2020-09-17 16:30 ` Miquel Raynal
2020-09-18 9:33 ` Evgeny Novikov
2020-09-18 9:33 ` Evgeny Novikov
2020-09-18 9:33 ` Evgeny Novikov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200916194045.6378-1-novikov@ispras.ru \
--to=novikov@ispras.ru \
--cc=boris.brezillon@collabora.com \
--cc=gustavo@embeddedor.com \
--cc=ldv-project@linuxtesting.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-mtd@lists.infradead.org \
--cc=matthias.bgg@gmail.com \
--cc=miquel.raynal@bootlin.com \
--cc=richard@nod.at \
--cc=swboyd@chromium.org \
--cc=vigneshr@ti.com \
--cc=yamada.masahiro@socionext.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.