summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorGeert Uytterhoeven <geert+renesas@glider.be>2022-06-21 16:22:26 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2022-06-27 17:21:05 +0300
commit19e506b317497a8c2b3ec2f12314d355d2f00ad0 (patch)
treefa4c6eb68f992be526fd719f9044a9b88d661e02 /include
parent03c765b0e3b4cb5063276b086c76f7a612856a9a (diff)
downloadlinux-19e506b317497a8c2b3ec2f12314d355d2f00ad0.tar.xz
eeprom: at25: Rework buggy read splitting
The recent change to split reads into chunks has several problems: 1. If an SPI controller has no transfer size limit, max_chunk is SIZE_MAX, and num_msgs becomes zero, causing no data to be read into the buffer, and exposing the original contents of the buffer to userspace, 2. If the requested read size is not a multiple of the maximum transfer size, the last transfer reads too much data, overflowing the buffer, 3. The loop logic differs from the write case. Fix the above by: 1. Keeping track of the number of bytes that are still to be transferred, instead of precalculating the number of messages and keeping track of the number of bytes tranfered, 2. Calculating the transfer size of each individual message, taking into account the number of bytes left, 3. Switching from a "while"-loop to a "do-while"-loop, and renaming "msg_count" to "segment". While at it, drop the superfluous cast from "unsigned int" to "unsigned int", also from at25_ee_write(), where it was probably copied from. Fixes: 0a35780c755ccec0 ("eeprom: at25: Split reads into chunks and cap write size") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/7ae260778d2c08986348ea48ce02ef148100e088.1655817534.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions