summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAhmad Fatoum <a.fatoum@pengutronix.de>2021-03-24 13:22:47 +0100
committerSascha Hauer <s.hauer@pengutronix.de>2021-03-25 13:46:09 +0100
commit1b09e7a392f342dc4999f1e9574e07449646b058 (patch)
tree0199a3a1421cb3643caacf1cb2b1e6bca90e2624 /drivers
parent518e7f902072858939c4fd0150c419a94adc7a87 (diff)
downloadbarebox-1b09e7a392f342dc4999f1e9574e07449646b058.tar.gz
barebox-1b09e7a392f342dc4999f1e9574e07449646b058.tar.xz
mtd: fix possible overflow during mtd size multiplication
LGTM[1] flags a couple of places where we write a 32-bit multiplication result into a 64-bit destination. While it might very well be that there are more places in need of fixing to support flashes bigger than 4G, fixing these issues is easy and reduces the noise. Do so. [1]: https://lgtm.com/projects/g/saschahauer/barebox/alerts/?mode=list Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/mtd/core.c2
-rw-r--r--drivers/mtd/mtdoob.c2
-rw-r--r--drivers/mtd/peb.c4
-rw-r--r--drivers/mtd/spi-nor/spi-nor.c2
4 files changed, 5 insertions, 5 deletions
diff --git a/drivers/mtd/core.c b/drivers/mtd/core.c
index 22eb2a056c..37fccda6be 100644
--- a/drivers/mtd/core.c
+++ b/drivers/mtd/core.c
@@ -131,7 +131,7 @@ static struct mtd_erase_region_info *mtd_find_erase_region(struct mtd_info *mtd,
for (i = 0; i < mtd->numeraseregions; i++) {
struct mtd_erase_region_info *e = &mtd->eraseregions[i];
- if (offset > e->offset + e->erasesize * e->numblocks)
+ if (offset > e->offset + (loff_t)e->erasesize * e->numblocks)
continue;
return e;
}
diff --git a/drivers/mtd/mtdoob.c b/drivers/mtd/mtdoob.c
index 04e064b227..19719c4d62 100644
--- a/drivers/mtd/mtdoob.c
+++ b/drivers/mtd/mtdoob.c
@@ -77,7 +77,7 @@ static int add_mtdoob_device(struct mtd_info *mtd, const char *devname, void **p
mtdoob = xzalloc(sizeof(*mtdoob));
mtdoob->cdev.ops = &mtd_ops_oob;
- mtdoob->cdev.size = mtd_div_by_wb(mtd->size, mtd) * mtd->oobsize;
+ mtdoob->cdev.size = mtd_div_by_wb(mtd->size, mtd) * (loff_t)mtd->oobsize;
mtdoob->cdev.name = basprintf("%s.oob", mtd->cdev.name);
mtdoob->cdev.priv = mtdoob;
mtdoob->cdev.dev = &mtd->dev;
diff --git a/drivers/mtd/peb.c b/drivers/mtd/peb.c
index f3c51a61b4..03d96c2a5a 100644
--- a/drivers/mtd/peb.c
+++ b/drivers/mtd/peb.c
@@ -695,7 +695,7 @@ int mtd_peb_create_bitflips(struct mtd_info *mtd, int pnum, int offset,
ops.ooblen = mtd->oobsize;
for (i = 0; i < pages_per_block; i++) {
- loff_t offs = (loff_t)pnum * mtd->erasesize + i * mtd->writesize;
+ loff_t offs = (loff_t)pnum * mtd->erasesize + i * (loff_t)mtd->writesize;
ops.datbuf = buf + i * mtd->writesize;
ops.oobbuf = oobbuf + i * mtd->oobsize;
@@ -738,7 +738,7 @@ int mtd_peb_create_bitflips(struct mtd_info *mtd, int pnum, int offset,
}
for (i = 0; i < pages_per_block; i++) {
- loff_t offs = (loff_t)pnum * mtd->erasesize + i * mtd->writesize;
+ loff_t offs = (loff_t)pnum * mtd->erasesize + i * (loff_t)mtd->writesize;
ops.datbuf = buf + i * mtd->writesize;
ops.oobbuf = oobbuf + i * mtd->oobsize;
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index bd748ff5b4..383916e3f4 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -1131,7 +1131,7 @@ static int spi_nor_init_params(struct spi_nor *nor,
memset(params, 0, sizeof(*params));
/* Set SPI NOR sizes. */
- params->size = info->sector_size * info->n_sectors;
+ params->size = info->sector_size * (u64)info->n_sectors;
params->page_size = info->page_size;
/* (Fast) Read settings. */