[PATCH 1/3] regmap: debugfs: Ensure we don't underflow when printing access masks

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod
From	Mark Brown <broonie@kernel.org>
Newsgroups	linux.kernel
Subject	[PATCH 1/3] regmap: debugfs: Ensure we don't underflow when printing access masks
Date	Sun, 20 Sep 2015 02:40:02 +0200
Message-ID	<qaAPE-JA-1@gated-at.bofh.it> (permalink)
X-Original-To	Rasmus Villemoes <linux@rasmusvillemoes.dk>
X-Mailer	git-send-email 2.5.0
X-Sa-Exim-Connect-IP	209.49.225.226
X-Sa-Exim-Mail-From	broonie@sirena.org.uk
X-Sa-Exim-Version	4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-Sa-Exim-Scanned	Yes (on mezzanine.sirena.org.uk)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	33
Organization	linux.* mail to news gateway
X-Original-Cc	linux-kernel@vger.kernel.org, Mark Brown <broonie@kernel.org>, stable@vger.kernel.org
X-Original-Date	Sat, 19 Sep 2015 07:37:49 -0700
X-Original-Message-ID	<1442673471-26849-1-git-send-email-broonie@kernel.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1228790

Show key headers only | View raw

If a read is attempted which is smaller than the line length then we may
underflow the subtraction we're doing with the unsigned size_t type so
move some of the calculation to be additions on the right hand side
instead in order to avoid this.

Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
---
 drivers/base/regmap/regmap-debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index f42f2ba..1f32789 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -432,7 +432,7 @@ static ssize_t regmap_access_read_file(struct file *file,
 		/* If we're in the region the user is trying to read */
 		if (p >= *ppos) {
 			/* ...but not beyond it */
-			if (buf_pos >= count - 1 - tot_len)
+			if (buf_pos + tot_len + 1 >= count)
 				break;
 
 			/* Format the register */
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH 1/3] regmap: debugfs: Ensure we don't underflow when printing access masks Mark Brown <broonie@kernel.org> - 2015-09-20 02:40 +0200
  [PATCH 3/3] regmap: debugfs: Remove scratch buffer for register length calculation Mark Brown <broonie@kernel.org> - 2015-09-20 02:40 +0200
  [PATCH 2/3] regmap: debugfs: Don't bother actually printing when calculating max length Mark Brown <broonie@kernel.org> - 2015-09-20 02:40 +0200

csiph-web