nvmem: mxs-ocotp read problem
Subsystems (2)
Hi,
the mxs_ocotp_read seems to incorrectly iterate through the memory to be read, resulting in a buffer overflow/off-area access and sometimes oops. The following patch seems to fix the problem
Regards
Stano
drivers/nvmem/mxs-ocotp.c +2 -2
@@ -94,7 +94,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size,if (ret) goto close_banks; -while (val_size) { +while (val_size >= reg_size) {if ((offset <OCOTP_DATA_OFFSET ) || (offset %16 )) {/* fill up non-data register */ *buf =0 ;
@@ -103,7 +103,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size, } buf++; - val_size--; + val_size -= reg_size; offset += reg_size; }
Hi Stano,
Am 26.04.2016 um 13:45 schrieb Stanislav Meduna:
Quoted 5 lines
Hi,
the
mxs_ocotp_readseems to incorrectly iterate through the memory to be read, resulting in a buffer overflow/off-area access and sometimes oops.
could you please provide me scenario, so i can test it.
Regards
Stefan
Quoted 28 lines
The following patch seems to fix
the problemRegards
Stanodrivers/nvmem/mxs-ocotp.c +2
-2@@ -94,7 +94,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size,if (ret) goto close_banks; -while (val_size) { +while (val_size >= reg_size) {if ((offset <OCOTP_DATA_OFFSET ) || (offset %16 )) {/* fill up non-data register */ *buf =0 ;@@ -103,7 +103,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size, } buf++; - val_size--; + val_size -= reg_size; offset += reg_size; }