Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 3afd522de8d8ec446efe957b86e4f63e3dd8ce9d

Authored by Roel Kluin
Committed by David Woodhouse
1 parent 5f877607cd
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[MTD] slram: Handle negative devlength correctly 

A negative devlength won't get noticed and clean up:

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Showing 1 changed file with 10 additions and 4 deletions Side-by-side Diff

drivers/mtd/devices/slram.c
Diff comments   View file @ 3afd522
... ... @@ -267,22 +267,28 @@
267 267 if (*(szlength) != '+') {
268 268 devlength = simple_strtoul(szlength, &buffer, 0);
269 269 devlength = handle_unit(devlength, buffer) - devstart;
  270 + if (devlength < devstart)
  271 + goto err_out;
  272 +
  273 + devlength -= devstart;
270 274 } else {
271 275 devlength = simple_strtoul(szlength + 1, &buffer, 0);
272 276 devlength = handle_unit(devlength, buffer);
273 277 }
274 278 T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n",
275 279 devname, devstart, devlength);
276   - if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) {
277   - E("slram: Illegal start / length parameter.\n");
278   - return(-EINVAL);
279   - }
  280 + if (devlength % SLRAM_BLK_SZ != 0)
  281 + goto err_out;
280 282  
281 283 if ((devstart = register_device(devname, devstart, devlength))){
282 284 unregister_devices();
283 285 return((int)devstart);
284 286 }
285 287 return(0);
  288 +
  289 +err_out:
  290 + E("slram: Illegal length parameter.\n");
  291 + return(-EINVAL);
286 292 }
287 293  
288 294 #ifndef MODULE