Skip to contentSkip to conversation

mfd: Fix off-by-one value range checking for tps65910_i2c_write

PATCH Superseded Axel Lin 3 participants 3 messages May 13, 2011 – May 16, 2011

Subsystems (2)
Multifunction devices (MFD) OMAP2+ support
lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH 1/1 mfd: Fix off-by-one value range checking for tps65910_i2c_write

If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

Signed-off-by Axel Lin <[email protected]>
---
 drivers/mfd/tps65910.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/mfd/tps65910.c +1 -1
index bf649cf..e318248 100644
@@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg,
 	u8 msg[TPS65910_MAX_REGISTER + 1];
 	int ret;
 
-	if (bytes > (TPS65910_MAX_REGISTER + 1))
+	if (bytes > TPS65910_MAX_REGISTER)
 		return -EINVAL;
 
 	msg[0] = reg;
Signature · 1 line
1.7.1
#1 lore raw

Hi Axel,

Quoted 2 lines · Axel Lin

If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

This code is going through Liam's tree, I'm adding him to this thread. Liam, please add my Acked-by to this patch, if you think it's needed.

Cheers,
Samuel.

Signature · 2 lines
Intel Open Source Technology Centre
http://oss.intel.com/
#2 lore raw
Quoted 8 lines · Samuel Ortiz

Hi Axel,

Quoted 2 lines · Axel Lin

If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

This code is going through Liam's tree, I'm adding him to this thread. Liam, please add my Acked-by to this patch, if you think it's needed.

Axel, could you resend to me with Samuels Ack and I'll apply.

Thanks

Liam