diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2022-09-30 01:27:06 +0300 |
|---|---|---|
| committer | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2022-10-06 23:54:56 +0300 |
| commit | 947d4f132b4d67a0d15859b354ed3fc71410105b (patch) | |
| tree | a071fa95199db1e53162b1bd6fae4e28c17692f5 /drivers/core | |
| parent | 2afa989fbecf25ea23902a9c480f179ba608785a (diff) | |
| download | u-boot-947d4f132b4d67a0d15859b354ed3fc71410105b.tar.xz | |
regmap: fix range checks
On the 32bit ARM sandbox 'dm ut dm_test_devm_regmap' fails with an abort.
This is due to incorrect range checks.
On 32-bit systems the size of size_t and int is both 32 bit. The expression
(offset + val_len) is bound to overflow if offset == -1. Add an overflow
check.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'drivers/core')
| -rw-r--r-- | drivers/core/regmap.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/core/regmap.c b/drivers/core/regmap.c index 5f98f85cfc..5ccbf9abb8 100644 --- a/drivers/core/regmap.c +++ b/drivers/core/regmap.c @@ -399,7 +399,7 @@ int regmap_raw_read_range(struct regmap *map, uint range_num, uint offset, range = &map->ranges[range_num]; offset <<= map->reg_offset_shift; - if (offset + val_len > range->size) { + if (offset + val_len > range->size || offset + val_len < offset) { debug("%s: offset/size combination invalid\n", __func__); return -ERANGE; } @@ -538,7 +538,7 @@ int regmap_raw_write_range(struct regmap *map, uint range_num, uint offset, range = &map->ranges[range_num]; offset <<= map->reg_offset_shift; - if (offset + val_len > range->size) { + if (offset + val_len > range->size || offset + val_len < offset) { debug("%s: offset/size combination invalid\n", __func__); return -ERANGE; } |