lkml.org 
[lkml]   [2018]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 034/164] regmap: Fix reversed bounds check in regmap_raw_write()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit f00e71091ab92eba52122332586c6ecaa9cd1a56 upstream.

    We're supposed to be checking that "val_len" is not too large but
    instead we check if it is smaller than the max.

    The only function affected would be regmap_i2c_smbus_i2c_write() in
    drivers/base/regmap/regmap-i2c.c. Strangely that function has its own
    limit check which returns an error if (count >= I2C_SMBUS_BLOCK_MAX) so
    it doesn't look like it has ever been able to do anything except return
    an error.

    Fixes: c335931ed9d2 ("regmap: Add raw_write/read checks for max_raw_write/read sizes")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/base/regmap/regmap.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/base/regmap/regmap.c
    +++ b/drivers/base/regmap/regmap.c
    @@ -1739,7 +1739,7 @@ int regmap_raw_write(struct regmap *map,
    return -EINVAL;
    if (val_len % map->format.val_bytes)
    return -EINVAL;
    - if (map->max_raw_write && map->max_raw_write > val_len)
    + if (map->max_raw_write && map->max_raw_write < val_len)
    return -E2BIG;

    map->lock(map->lock_arg);

    \
     
     \ /
      Last update: 2018-04-22 17:30    [W:2.644 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site