* [PATCH] onenand: test before subtraction on unsigned
@ 2009-03-04 14:09 Roel Kluin
2009-03-04 14:49 ` Adrian Hunter
0 siblings, 1 reply; 3+ messages in thread
From: Roel Kluin @ 2009-03-04 14:09 UTC (permalink / raw)
To: kyungmin.park; +Cc: Andrew Morton, linux-mtd
len is unsigned so will wrap around when sizeof(struct otp_info) is greater than
len.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 529af27..7c2ebe9 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -2296,11 +2296,12 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
if (!action) { /* OTP Info functions */
struct otp_info *otpinfo;
- len -= sizeof(struct otp_info);
- if (len <= 0) {
+ if (len <= sizeof(struct otp_info)) {
+ len = 0;
ret = -ENOSPC;
break;
}
+ len -= sizeof(struct otp_info);
otpinfo = (struct otp_info *) buf;
otpinfo->start = from;
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] onenand: test before subtraction on unsigned
2009-03-04 14:09 [PATCH] onenand: test before subtraction on unsigned Roel Kluin
@ 2009-03-04 14:49 ` Adrian Hunter
2009-03-04 15:18 ` Roel Kluin
0 siblings, 1 reply; 3+ messages in thread
From: Adrian Hunter @ 2009-03-04 14:49 UTC (permalink / raw)
To: Roel Kluin
Cc: kyungmin.park@samsung.com, linux-mtd@lists.infradead.org,
Andrew Morton
Roel Kluin wrote:
> len is unsigned so will wrap around when sizeof(struct otp_info) is greater than
> len.
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
> index 529af27..7c2ebe9 100644
> --- a/drivers/mtd/onenand/onenand_base.c
> +++ b/drivers/mtd/onenand/onenand_base.c
> @@ -2296,11 +2296,12 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
> if (!action) { /* OTP Info functions */
> struct otp_info *otpinfo;
>
> - len -= sizeof(struct otp_info);
> - if (len <= 0) {
> + if (len <= sizeof(struct otp_info)) {
> + len = 0;
len is not used anymore, so no need to set it to zero.
> ret = -ENOSPC;
> break;
> }
> + len -= sizeof(struct otp_info);
>
> otpinfo = (struct otp_info *) buf;
> otpinfo->start = from;
So is there somewhere that is passing a buffer too small for all the opt_info?
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] onenand: test before subtraction on unsigned
2009-03-04 14:49 ` Adrian Hunter
@ 2009-03-04 15:18 ` Roel Kluin
0 siblings, 0 replies; 3+ messages in thread
From: Roel Kluin @ 2009-03-04 15:18 UTC (permalink / raw)
To: Adrian Hunter
Cc: kyungmin.park@samsung.com, linux-mtd@lists.infradead.org,
Andrew Morton
Adrian Hunter wrote:
> Roel Kluin wrote:
>> len is unsigned so will wrap around when sizeof(struct otp_info) is
>> greater than
>> len.
>> - len -= sizeof(struct otp_info);
>> - if (len <= 0) {
>> + if (len <= sizeof(struct otp_info)) {
>> + len = 0;
>
> len is not used anymore, so no need to set it to zero.
Right, updated patch below.
>> ret = -ENOSPC;
>> break;
>> }
>> + len -= sizeof(struct otp_info);
> So is there somewhere that is passing a buffer too small for all the
> opt_info?
I don't know, I found it by code inspection.
------------------------------>8-------------8<---------------------------------
len is unsigned so will wrap around when sizeof(struct otp_info) is greater than
len.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 529af27..1219a18 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -2296,11 +2296,11 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
if (!action) { /* OTP Info functions */
struct otp_info *otpinfo;
- len -= sizeof(struct otp_info);
- if (len <= 0) {
+ if (len <= sizeof(struct otp_info)) {
ret = -ENOSPC;
break;
}
+ len -= sizeof(struct otp_info);
otpinfo = (struct otp_info *) buf;
otpinfo->start = from;
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2009-03-04 15:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-03-04 14:09 [PATCH] onenand: test before subtraction on unsigned Roel Kluin
2009-03-04 14:49 ` Adrian Hunter
2009-03-04 15:18 ` Roel Kluin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox