mtd: mtdram: check offs and len in mtdram->erase

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=ab84fce518175aa09ec6e1bb50c2b41dad3e610a
Commit:     ab84fce518175aa09ec6e1bb50c2b41dad3e610a
Parent:     d3e94f3f2c0f669dfa0d0d51645d5d7d13a9c074
Author:     Dongsheng Yang <yangds.fnst at cn.fujitsu.com>
AuthorDate: Wed Sep 30 09:01:19 2015 +0800
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Mon Oct 19 18:08:33 2015 -0700

    mtd: mtdram: check offs and len in mtdram->erase
    
    We should prevent user to erasing mtd device with
    an unaligned offset or length.
    
    Signed-off-by: Dongsheng Yang <yangds.fnst at cn.fujitsu.com>
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
---
 drivers/mtd/devices/mtdram.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index 8e28508..627a9bc 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -32,8 +32,29 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB");
 // We could store these in the mtd structure, but we only support 1 device..
 static struct mtd_info *mtd_info;
 
+static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+	int ret = 0;
+
+	/* Start address must align on block boundary */
+	if (mtd_mod_by_eb(ofs, mtd)) {
+		pr_debug("%s: unaligned address\n", __func__);
+		ret = -EINVAL;
+	}
+
+	/* Length must align on block boundary */
+	if (mtd_mod_by_eb(len, mtd)) {
+		pr_debug("%s: length not block aligned\n", __func__);
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
+	if (check_offs_len(mtd, instr->addr, instr->len))
+		return -EINVAL;
 	memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
 	instr->state = MTD_ERASE_DONE;
 	mtd_erase_callback(instr);