All of lore.kernel.org
 help / color / mirror / Atom feed
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Evgeny Novikov <novikov@ispras.ru>
Cc: ldv-project@linuxtesting.org,
	Vignesh Raghavendra <vigneshr@ti.com>,
	"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
	Richard Weinberger <richard@nod.at>,
	linux-kernel@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>,
	Masahiro Yamada <yamada.masahiro@socionext.com>,
	Boris Brezillon <boris.brezillon@collabora.com>,
	linux-mtd@lists.infradead.org,
	Matthias Brugger <matthias.bgg@gmail.com>,
	linux-mediatek@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Thu, 17 Sep 2020 18:30:01 +0200	[thread overview]
Message-ID: <20200917183001.393245e8@xps13> (raw)
In-Reply-To: <20200916194045.6378-1-novikov@ispras.ru>

Hi Evgeny,

Evgeny Novikov <novikov@ispras.ru> wrote on Wed, 16 Sep 2020 22:40:45
+0300:

> If of_get_property() will set nsels to negative values the driver may

Is this really a possible case?

Looking at the OF code, I don't think it can ever happen...

> allocate insufficient memory for chip. Moreover, there may be underflow
> for devm_kzalloc(). This can result in various bad consequences later.
> The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
> nsels.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
> ---
>  drivers/mtd/nand/raw/mtk_nand.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
> index ad1b55dab211..df98a2eec240 100644
> --- a/drivers/mtd/nand/raw/mtk_nand.c
> +++ b/drivers/mtd/nand/raw/mtk_nand.c
> @@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
>  		return -ENODEV;
>  
>  	nsels /= sizeof(u32);
> -	if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
> +	if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
>  		dev_err(dev, "invalid reg property size %d\n", nsels);
>  		return -EINVAL;
>  	}

Thanks,
Miquèl

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

WARNING: multiple messages have this Message-ID (diff)
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Evgeny Novikov <novikov@ispras.ru>
Cc: ldv-project@linuxtesting.org,
	Vignesh Raghavendra <vigneshr@ti.com>,
	"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
	Richard Weinberger <richard@nod.at>,
	linux-kernel@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>,
	Masahiro Yamada <yamada.masahiro@socionext.com>,
	Boris Brezillon <boris.brezillon@collabora.com>,
	linux-mtd@lists.infradead.org,
	Matthias Brugger <matthias.bgg@gmail.com>,
	linux-mediatek@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Thu, 17 Sep 2020 18:30:01 +0200	[thread overview]
Message-ID: <20200917183001.393245e8@xps13> (raw)
In-Reply-To: <20200916194045.6378-1-novikov@ispras.ru>

Hi Evgeny,

Evgeny Novikov <novikov@ispras.ru> wrote on Wed, 16 Sep 2020 22:40:45
+0300:

> If of_get_property() will set nsels to negative values the driver may

Is this really a possible case?

Looking at the OF code, I don't think it can ever happen...

> allocate insufficient memory for chip. Moreover, there may be underflow
> for devm_kzalloc(). This can result in various bad consequences later.
> The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
> nsels.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
> ---
>  drivers/mtd/nand/raw/mtk_nand.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
> index ad1b55dab211..df98a2eec240 100644
> --- a/drivers/mtd/nand/raw/mtk_nand.c
> +++ b/drivers/mtd/nand/raw/mtk_nand.c
> @@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
>  		return -ENODEV;
>  
>  	nsels /= sizeof(u32);
> -	if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
> +	if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
>  		dev_err(dev, "invalid reg property size %d\n", nsels);
>  		return -EINVAL;
>  	}

Thanks,
Miquèl

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

WARNING: multiple messages have this Message-ID (diff)
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Evgeny Novikov <novikov@ispras.ru>
Cc: ldv-project@linuxtesting.org,
	Vignesh Raghavendra <vigneshr@ti.com>,
	"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
	Richard Weinberger <richard@nod.at>,
	linux-kernel@vger.kernel.org, Stephen Boyd <swboyd@chromium.org>,
	Masahiro Yamada <yamada.masahiro@socionext.com>,
	Boris Brezillon <boris.brezillon@collabora.com>,
	linux-mtd@lists.infradead.org,
	Matthias Brugger <matthias.bgg@gmail.com>,
	linux-mediatek@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Thu, 17 Sep 2020 18:30:01 +0200	[thread overview]
Message-ID: <20200917183001.393245e8@xps13> (raw)
In-Reply-To: <20200916194045.6378-1-novikov@ispras.ru>

Hi Evgeny,

Evgeny Novikov <novikov@ispras.ru> wrote on Wed, 16 Sep 2020 22:40:45
+0300:

> If of_get_property() will set nsels to negative values the driver may

Is this really a possible case?

Looking at the OF code, I don't think it can ever happen...

> allocate insufficient memory for chip. Moreover, there may be underflow
> for devm_kzalloc(). This can result in various bad consequences later.
> The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
> nsels.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
> ---
>  drivers/mtd/nand/raw/mtk_nand.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
> index ad1b55dab211..df98a2eec240 100644
> --- a/drivers/mtd/nand/raw/mtk_nand.c
> +++ b/drivers/mtd/nand/raw/mtk_nand.c
> @@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
>  		return -ENODEV;
>  
>  	nsels /= sizeof(u32);
> -	if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
> +	if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
>  		dev_err(dev, "invalid reg property size %d\n", nsels);
>  		return -EINVAL;
>  	}

Thanks,
Miquèl

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

WARNING: multiple messages have this Message-ID (diff)
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Evgeny Novikov <novikov@ispras.ru>
Cc: Richard Weinberger <richard@nod.at>,
	Vignesh Raghavendra <vigneshr@ti.com>,
	Matthias Brugger <matthias.bgg@gmail.com>,
	Boris Brezillon <boris.brezillon@collabora.com>,
	"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
	Masahiro Yamada <yamada.masahiro@socionext.com>,
	Stephen Boyd <swboyd@chromium.org>,
	linux-mtd@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org,
	ldv-project@linuxtesting.org
Subject: Re: [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init()
Date: Thu, 17 Sep 2020 18:30:01 +0200	[thread overview]
Message-ID: <20200917183001.393245e8@xps13> (raw)
In-Reply-To: <20200916194045.6378-1-novikov@ispras.ru>

Hi Evgeny,

Evgeny Novikov <novikov@ispras.ru> wrote on Wed, 16 Sep 2020 22:40:45
+0300:

> If of_get_property() will set nsels to negative values the driver may

Is this really a possible case?

Looking at the OF code, I don't think it can ever happen...

> allocate insufficient memory for chip. Moreover, there may be underflow
> for devm_kzalloc(). This can result in various bad consequences later.
> The patch causes mtk_nfc_nand_chip_init() to fail for negative values of
> nsels.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
> ---
>  drivers/mtd/nand/raw/mtk_nand.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
> index ad1b55dab211..df98a2eec240 100644
> --- a/drivers/mtd/nand/raw/mtk_nand.c
> +++ b/drivers/mtd/nand/raw/mtk_nand.c
> @@ -1376,7 +1376,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
>  		return -ENODEV;
>  
>  	nsels /= sizeof(u32);
> -	if (!nsels || nsels > MTK_NAND_MAX_NSELS) {
> +	if (nsels <= 0 || nsels > MTK_NAND_MAX_NSELS) {
>  		dev_err(dev, "invalid reg property size %d\n", nsels);
>  		return -EINVAL;
>  	}

Thanks,
Miquèl

  reply	other threads:[~2020-09-17 16:30 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-16 19:40 [PATCH] mtd: rawnand: mtk: avoid underflow in mtk_nfc_nand_chip_init() Evgeny Novikov
2020-09-16 19:40 ` Evgeny Novikov
2020-09-16 19:40 ` Evgeny Novikov
2020-09-16 19:40 ` Evgeny Novikov
2020-09-17 16:30 ` Miquel Raynal [this message]
2020-09-17 16:30   ` Miquel Raynal
2020-09-17 16:30   ` Miquel Raynal
2020-09-17 16:30   ` Miquel Raynal
2020-09-18  9:33   ` Evgeny Novikov
2020-09-18  9:33     ` Evgeny Novikov
2020-09-18  9:33     ` Evgeny Novikov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200917183001.393245e8@xps13 \
    --to=miquel.raynal@bootlin.com \
    --cc=boris.brezillon@collabora.com \
    --cc=gustavo@embeddedor.com \
    --cc=ldv-project@linuxtesting.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mediatek@lists.infradead.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=matthias.bgg@gmail.com \
    --cc=novikov@ispras.ru \
    --cc=richard@nod.at \
    --cc=swboyd@chromium.org \
    --cc=vigneshr@ti.com \
    --cc=yamada.masahiro@socionext.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.