regmap: use proper part of work_buf for storing val

The map->work_buf is a buffer preallocated in __regmap_init() with size allowing it to store all 3 parts of a buffer - reg, pad and val. While reg and val parts are always properly setup before each transaction, the pad part is left at its default value (zeros). Until it is overwritten, that is.

_regmap_bus_read(), when calling _regmap_raw_read() uses beginning of work_buf as a place to store data read. Usually that is fine but if val_bits > reg_bits && pad_bits > 0, padding area of work_buf() may get overwritten. Since padding is not zeroed before each transaction, garbage will be used on next calls.

This patch moves the val pointer used for _regmap_raw_read() to point to a part of work_buf intended for storing value read.

---
drivers/base/regmap/regmap.c | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

index b9a779a4a739..d8806eac2708 100644
@@ -2344,13 +2344,15 @@ static int _regmap_bus_read(void *context, unsigned int reg,

{
	int ret;
	struct regmap *map = context;

+ void *work_val = map->work_buf + map->format.reg_bytes +
+ map->format.pad_bytes;

	if (!map->format.parse_val)
		return -EINVAL;

- ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);

+	ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes);
	if (ret == 0)

- *val = map->format.parse_val(map->work_buf);
+ *val = map->format.parse_val(work_val);

	return ret;
}

2.13.6

The patch

regmap: use proper part of work_buf for storing val

has been applied to the regmap tree at

https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git

All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying to this mail.

Thanks,
Mark

From: Krzysztof Adamski <[email protected]>
Date: Thu, 30 Nov 2017 15:09:15 +0100
Subject: [PATCH] regmap: use proper part of work_buf for storing val

The map->work_buf is a buffer preallocated in __regmap_init() with size allowing it to store all 3 parts of a buffer - reg, pad and val. While reg and val parts are always properly setup before each transaction, the pad part is left at its default value (zeros). Until it is overwritten, that is.

_regmap_bus_read(), when calling _regmap_raw_read() uses beginning of work_buf as a place to store data read. Usually that is fine but if val_bits > reg_bits && pad_bits > 0, padding area of work_buf() may get overwritten. Since padding is not zeroed before each transaction, garbage will be used on next calls.

This patch moves the val pointer used for _regmap_raw_read() to point to a part of work_buf intended for storing value read.

---
 drivers/base/regmap/regmap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index 8d516a9bfc01..9fb3a792642b 100644
@@ -2423,13 +2423,15 @@ static int _regmap_bus_read(void *context, unsigned int reg,
 {
 	int ret;
 	struct regmap *map = context;
+	void *work_val = map->work_buf + map->format.reg_bytes +
+		map->format.pad_bytes;
 
 	if (!map->format.parse_val)
 		return -EINVAL;
 
-	ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);
+	ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes);
 	if (ret == 0)
-		*val = map->format.parse_val(map->work_buf);
+		*val = map->format.parse_val(work_val);
 
 	return ret;
 }

2.15.1