From patchwork Thu Feb 19 08:40:55 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srinivas Kandagatla X-Patchwork-Id: 44805 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-we0-f199.google.com (mail-we0-f199.google.com [74.125.82.199]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 20C0C21553 for ; Thu, 19 Feb 2015 08:41:18 +0000 (UTC) Received: by wesq59 with SMTP id q59sf4099952wes.2 for ; Thu, 19 Feb 2015 00:41:17 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:sender:precedence:list-id :x-original-sender:x-original-authentication-results:mailing-list :list-post:list-help:list-archive:list-unsubscribe; bh=W2JtZmi6BbabZoxGGjFdUJ4C2/xFtp18tXRbGqoQsRY=; b=BcO2jb0cn0hVcfLVN1v5B4KdtMPnw0E0T7D2SnBNEQooIxBQk9a7jhifFssZRx13wW jnKx4XFg13XeZZdqJrmpaY/bb4HVOhK/5uTwbOTecGOw/3nuqpMHcq5RIFXjiKa8NCTn Skvm17hhc01e00RKD6ComMWv9Zbyv+YrhkRvcPXwlq1Uxm/2jjscxsNVSCM18LPv8TxT FkxxyVDLw3PY+2cYpnjnMi/e6c0a+cAoDAfSHu//JYJIgnl9xtrafLtTFQDJw0vJY3WP VrN9B/9AJ/goZYF+s3VgL8ZXw7KxPmfRuXhsYt/hbMiP7f5sIx+ITFXxGHL0tyrZKMd7 RLmA== X-Gm-Message-State: ALoCoQkU4dhLqM0jaAg1nagg5I/PKSiL3pi/y0WalqyMTC2P1I1Ns1w/rrH0+yAcR/6NQUSANJHT X-Received: by 10.152.19.100 with SMTP id d4mr394528lae.7.1424335277406; Thu, 19 Feb 2015 00:41:17 -0800 (PST) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.224.129 with SMTP id rc1ls124291lac.48.gmail; Thu, 19 Feb 2015 00:41:17 -0800 (PST) X-Received: by 10.152.21.5 with SMTP id r5mr3057112lae.24.1424335277213; Thu, 19 Feb 2015 00:41:17 -0800 (PST) Received: from mail-lb0-f173.google.com (mail-lb0-f173.google.com. [209.85.217.173]) by mx.google.com with ESMTPS id u9si12492914lag.108.2015.02.19.00.41.17 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Feb 2015 00:41:17 -0800 (PST) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.173 as permitted sender) client-ip=209.85.217.173; Received: by lbdu10 with SMTP id u10so6093637lbd.7 for ; Thu, 19 Feb 2015 00:41:17 -0800 (PST) X-Received: by 10.152.43.51 with SMTP id t19mr2817072lal.73.1424335277130; Thu, 19 Feb 2015 00:41:17 -0800 (PST) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.35.133 with SMTP id h5csp355633lbj; Thu, 19 Feb 2015 00:41:16 -0800 (PST) X-Received: by 10.66.250.137 with SMTP id zc9mr5650150pac.55.1424335274589; Thu, 19 Feb 2015 00:41:14 -0800 (PST) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id yp2si7461864pab.74.2015.02.19.00.41.13; Thu, 19 Feb 2015 00:41:14 -0800 (PST) Received-SPF: none (google.com: linux-kernel-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752647AbbBSIlE (ORCPT + 28 others); Thu, 19 Feb 2015 03:41:04 -0500 Received: from mail-we0-f180.google.com ([74.125.82.180]:42922 "EHLO mail-we0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752592AbbBSIlB (ORCPT ); Thu, 19 Feb 2015 03:41:01 -0500 Received: by wesw62 with SMTP id w62so5803581wes.9 for ; Thu, 19 Feb 2015 00:41:00 -0800 (PST) X-Received: by 10.180.188.41 with SMTP id fx9mr7857522wic.93.1424335260498; Thu, 19 Feb 2015 00:41:00 -0800 (PST) Received: from srini-ThinkPad-X1-Carbon-2nd.dlink.com (host-2-98-213-113.as13285.net. [2.98.213.113]) by mx.google.com with ESMTPSA id df8sm29151134wib.2.2015.02.19.00.40.59 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 19 Feb 2015 00:40:59 -0800 (PST) From: Srinivas Kandagatla To: Mark Brown Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Srinivas Kandagatla Subject: [PATCH 2/2] regmap: Add range check in _regmap_raw_write() Date: Thu, 19 Feb 2015 08:40:55 +0000 Message-Id: <1424335255-7517-1-git-send-email-srinivas.kandagatla@linaro.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1424335193-7431-1-git-send-email-srinivas.kandagatla@linaro.org> References: <1424335193-7431-1-git-send-email-srinivas.kandagatla@linaro.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: srinivas.kandagatla@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.173 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , regmap_bulk_write() ends up using the path that invokes _regmap_raw_write(), however _regmap_raw_write() never checks if the registers that are accessed are actually within the accessible range. This results in kernel crashes when trying to access registers beyond max_registers. This patch just adds check before accessing the register range. Signed-off-by: Srinivas Kandagatla --- drivers/base/regmap/regmap.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index d480e49..32ce7b3 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1202,16 +1202,14 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg, void *buf; int ret = -ENOTSUPP; size_t len; - int i; + int i, count = val_len/map->format.val_bytes; WARN_ON(!map->bus); /* Check for unwritable registers before we start */ - if (map->writeable_reg) - for (i = 0; i < val_len / map->format.val_bytes; i++) - if (!map->writeable_reg(map->dev, - reg + (i * map->reg_stride))) - return -EINVAL; + for (i = 0; i < count; i++) + if (!regmap_writeable(map, reg + (i * map->reg_stride))) + return -EINVAL; if (!map->cache_bypass && map->format.parse_val) { unsigned int ival;