diff options
author | Sascha Hauer <s.hauer@pengutronix.de> | 2016-02-25 12:12:09 +0100 |
---|---|---|
committer | Sascha Hauer <s.hauer@pengutronix.de> | 2016-03-04 08:23:06 +0100 |
commit | 568e345d5acb380bdd25012f751d7c6eeef27699 (patch) | |
tree | cc20f23cc3694fc079254984c99ccf5cd2fa386c /drivers/mtd/core.c | |
parent | 53eff047f96a7d1a8eb899619ce659945ab4a7d2 (diff) | |
download | barebox-568e345d5acb380bdd25012f751d7c6eeef27699.tar.gz barebox-568e345d5acb380bdd25012f751d7c6eeef27699.tar.xz |
mtd: mtd_[read|write|erase]: check for valid input data
mtd_[read|write|erase] are input functions to the mtd subsystem, so
check for valid input data here rather than relying on the drivers doing
this. The checks are copied from the Kernel as of 4.5-rc5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'drivers/mtd/core.c')
-rw-r--r-- | drivers/mtd/core.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/drivers/mtd/core.c b/drivers/mtd/core.c index e35571dc3d..161c6ad874 100644 --- a/drivers/mtd/core.c +++ b/drivers/mtd/core.c @@ -326,6 +326,11 @@ int mtd_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, int ret_code; *retlen = 0; + if (from < 0 || from >= mtd->size || len > mtd->size - from) + return -EINVAL; + if (!len) + return 0; + /* * In the absence of an error, drivers return a non-negative integer * representing the maximum number of bitflips that were corrected on @@ -344,11 +349,28 @@ int mtd_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, { *retlen = 0; + if (to < 0 || to >= mtd->size || len > mtd->size - to) + return -EINVAL; + if (!mtd->write || !(mtd->flags & MTD_WRITEABLE)) + return -EROFS; + if (!len) + return 0; + return mtd->write(mtd, to, len, retlen, buf); } int mtd_erase(struct mtd_info *mtd, struct erase_info *instr) { + if (instr->addr >= mtd->size || instr->len > mtd->size - instr->addr) + return -EINVAL; + if (!(mtd->flags & MTD_WRITEABLE)) + return -EROFS; + instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN; + if (!instr->len) { + instr->state = MTD_ERASE_DONE; + mtd_erase_callback(instr); + return 0; + } return mtd->erase(mtd, instr); } |