[PATCH] regmap: use proper part of work_buf for storing val

[PATCH] regmap: use proper part of work_buf for storing val

[Krzysztof Adamski]

The map->work_buf is a buffer preallocated in __regmap_init() with size
allowing it to store all 3 parts of a buffer - reg, pad and val. While
reg and val parts are always properly setup before each transaction, the
pad part is left at its default value (zeros). Until it is overwritten,
that is.

_regmap_bus_read(), when calling _regmap_raw_read() uses beginning of
work_buf as a place to store data read. Usually that is fine but if
val_bits > reg_bits && pad_bits > 0, padding area of work_buf() may get
overwritten. Since padding is not zeroed before each transaction,
garbage will be used on next calls.

This patch moves the val pointer used for _regmap_raw_read() to point
to a part of work_buf intended for storing value read.

Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
---
 drivers/base/regmap/regmap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index b9a779a4a739..d8806eac2708 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -2344,13 +2344,15 @@ static int _regmap_bus_read(void *context, unsigned int reg,
 {
 	int ret;
 	struct regmap *map = context;
+	void *work_val = map->work_buf + map->format.reg_bytes +
+		map->format.pad_bytes;
 
 	if (!map->format.parse_val)
 		return -EINVAL;
 
-	ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);
+	ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes);
 	if (ret == 0)
-		*val = map->format.parse_val(map->work_buf);
+		*val = map->format.parse_val(work_val);
 
 	return ret;
 }
-- 
2.13.6

Applied "regmap: use proper part of work_buf for storing val" to the regmap tree

[Mark Brown]

The patch

   regmap: use proper part of work_buf for storing val

has been applied to the regmap tree at

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git 

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.  

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

>From 4c90f297ffcffb84e8667e4f447aeaba52a37220 Mon Sep 17 00:00:00 2001
From: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Date: Thu, 30 Nov 2017 15:09:15 +0100
Subject: [PATCH] regmap: use proper part of work_buf for storing val

The map->work_buf is a buffer preallocated in __regmap_init() with size
allowing it to store all 3 parts of a buffer - reg, pad and val. While
reg and val parts are always properly setup before each transaction, the
pad part is left at its default value (zeros). Until it is overwritten,
that is.

_regmap_bus_read(), when calling _regmap_raw_read() uses beginning of
work_buf as a place to store data read. Usually that is fine but if
val_bits > reg_bits && pad_bits > 0, padding area of work_buf() may get
overwritten. Since padding is not zeroed before each transaction,
garbage will be used on next calls.

This patch moves the val pointer used for _regmap_raw_read() to point
to a part of work_buf intended for storing value read.

Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/base/regmap/regmap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 8d516a9bfc01..9fb3a792642b 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -2423,13 +2423,15 @@ static int _regmap_bus_read(void *context, unsigned int reg,
 {
 	int ret;
 	struct regmap *map = context;
+	void *work_val = map->work_buf + map->format.reg_bytes +
+		map->format.pad_bytes;
 
 	if (!map->format.parse_val)
 		return -EINVAL;
 
-	ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);
+	ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes);
 	if (ret == 0)
-		*val = map->format.parse_val(map->work_buf);
+		*val = map->format.parse_val(work_val);
 
 	return ret;
 }
-- 
2.15.1