summaryrefslogtreecommitdiff
path: root/drivers/mtd/mtdcore.c
diff options
context:
space:
mode:
authorBrian Norris <computersforpeace@gmail.com>2014-07-22 06:06:27 +0400
committerBrian Norris <computersforpeace@gmail.com>2014-08-19 22:53:07 +0400
commit0c2b4e21444d0e274e91fc7db85caddb30988853 (patch)
tree32be90002a86d1fe29f1675c1baed664bcf290ff /drivers/mtd/mtdcore.c
parent36c6a7ac74044b8025488c018279115bb3c32eb0 (diff)
downloadlinux-0c2b4e21444d0e274e91fc7db85caddb30988853.tar.xz
mtd: correct upper bounds check for mtd_*() APIs
When checking the upper boundary (i.e., whether an address is higher than the maximum size of the MTD), we should be doing an inclusive check (greater or equal). For instance, an address of 16MB (0x1000000) on a 16MB device is invalid. The strengthening of this bounds check is redundant for those which already have a address+length check and ensure that the length is non-zero, but let's just fix them all, for completeness. Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Diffstat (limited to 'drivers/mtd/mtdcore.c')
-rw-r--r--drivers/mtd/mtdcore.c26
1 files changed, 13 insertions, 13 deletions
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index e4831b4159db..c1015173f2d9 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -778,7 +778,7 @@ EXPORT_SYMBOL_GPL(__put_mtd_device);
*/
int mtd_erase(struct mtd_info *mtd, struct erase_info *instr)
{
- if (instr->addr > mtd->size || instr->len > mtd->size - instr->addr)
+ if (instr->addr >= mtd->size || instr->len > mtd->size - instr->addr)
return -EINVAL;
if (!(mtd->flags & MTD_WRITEABLE))
return -EROFS;
@@ -804,7 +804,7 @@ int mtd_point(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen,
*phys = 0;
if (!mtd->_point)
return -EOPNOTSUPP;
- if (from < 0 || from > mtd->size || len > mtd->size - from)
+ if (from < 0 || from >= mtd->size || len > mtd->size - from)
return -EINVAL;
if (!len)
return 0;
@@ -817,7 +817,7 @@ int mtd_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
{
if (!mtd->_point)
return -EOPNOTSUPP;
- if (from < 0 || from > mtd->size || len > mtd->size - from)
+ if (from < 0 || from >= mtd->size || len > mtd->size - from)
return -EINVAL;
if (!len)
return 0;
@@ -835,7 +835,7 @@ unsigned long mtd_get_unmapped_area(struct mtd_info *mtd, unsigned long len,
{
if (!mtd->_get_unmapped_area)
return -EOPNOTSUPP;
- if (offset > mtd->size || len > mtd->size - offset)
+ if (offset >= mtd->size || len > mtd->size - offset)
return -EINVAL;
return mtd->_get_unmapped_area(mtd, len, offset, flags);
}
@@ -846,7 +846,7 @@ int mtd_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen,
{
int ret_code;
*retlen = 0;
- if (from < 0 || from > mtd->size || len > mtd->size - from)
+ if (from < 0 || from >= mtd->size || len > mtd->size - from)
return -EINVAL;
if (!len)
return 0;
@@ -869,7 +869,7 @@ int mtd_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen,
const u_char *buf)
{
*retlen = 0;
- if (to < 0 || to > mtd->size || len > mtd->size - to)
+ if (to < 0 || to >= mtd->size || len > mtd->size - to)
return -EINVAL;
if (!mtd->_write || !(mtd->flags & MTD_WRITEABLE))
return -EROFS;
@@ -892,7 +892,7 @@ int mtd_panic_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen,
*retlen = 0;
if (!mtd->_panic_write)
return -EOPNOTSUPP;
- if (to < 0 || to > mtd->size || len > mtd->size - to)
+ if (to < 0 || to >= mtd->size || len > mtd->size - to)
return -EINVAL;
if (!(mtd->flags & MTD_WRITEABLE))
return -EROFS;
@@ -1011,7 +1011,7 @@ int mtd_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
{
if (!mtd->_lock)
return -EOPNOTSUPP;
- if (ofs < 0 || ofs > mtd->size || len > mtd->size - ofs)
+ if (ofs < 0 || ofs >= mtd->size || len > mtd->size - ofs)
return -EINVAL;
if (!len)
return 0;
@@ -1023,7 +1023,7 @@ int mtd_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
{
if (!mtd->_unlock)
return -EOPNOTSUPP;
- if (ofs < 0 || ofs > mtd->size || len > mtd->size - ofs)
+ if (ofs < 0 || ofs >= mtd->size || len > mtd->size - ofs)
return -EINVAL;
if (!len)
return 0;
@@ -1035,7 +1035,7 @@ int mtd_is_locked(struct mtd_info *mtd, loff_t ofs, uint64_t len)
{
if (!mtd->_is_locked)
return -EOPNOTSUPP;
- if (ofs < 0 || ofs > mtd->size || len > mtd->size - ofs)
+ if (ofs < 0 || ofs >= mtd->size || len > mtd->size - ofs)
return -EINVAL;
if (!len)
return 0;
@@ -1045,7 +1045,7 @@ EXPORT_SYMBOL_GPL(mtd_is_locked);
int mtd_block_isreserved(struct mtd_info *mtd, loff_t ofs)
{
- if (ofs < 0 || ofs > mtd->size)
+ if (ofs < 0 || ofs >= mtd->size)
return -EINVAL;
if (!mtd->_block_isreserved)
return 0;
@@ -1055,7 +1055,7 @@ EXPORT_SYMBOL_GPL(mtd_block_isreserved);
int mtd_block_isbad(struct mtd_info *mtd, loff_t ofs)
{
- if (ofs < 0 || ofs > mtd->size)
+ if (ofs < 0 || ofs >= mtd->size)
return -EINVAL;
if (!mtd->_block_isbad)
return 0;
@@ -1067,7 +1067,7 @@ int mtd_block_markbad(struct mtd_info *mtd, loff_t ofs)
{
if (!mtd->_block_markbad)
return -EOPNOTSUPP;
- if (ofs < 0 || ofs > mtd->size)
+ if (ofs < 0 || ofs >= mtd->size)
return -EINVAL;
if (!(mtd->flags & MTD_WRITEABLE))
return -EROFS;