linux-kernel - [PATCH 1/5] regmap: Format data for raw write in regmap_bulk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Feb 2018 12:59:10 +0000
From:   Charles Keepax <ckeepax@...nsource.cirrus.com>
To:     <broonie@...nel.org>
CC:     <linux-kernel@...r.kernel.org>, <patches@...nsource.cirrus.com>
Subject: [PATCH 1/5] regmap: Format data for raw write in regmap_bulk_write

In the case were the bulk transaction is split up into smaller chunks
data is passed directly to regmap_raw_write. However regmap_bulk_write
uses data in host endian and regmap_raw_write expects data in device
endian. As such if the host and device differ in endian the wrong data
will be written to the device. Correct this issue using a similar
approach to the single raw write case below it, duplicate the data
into a new buffer and use parse_inplace to format the data correctly.

Fixes: adaac459759d ("regmap: Introduce max_raw_read/write for regmap_bulk_read/write")
Signed-off-by: Charles Keepax <ckeepax@...nsource.cirrus.com>
---
 drivers/base/regmap/regmap.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index b38ba6fdecbc..8a6de76f89bb 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -2005,6 +2005,17 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
 		int chunk_stride = map->reg_stride;
 		size_t chunk_size = val_bytes;
 		size_t chunk_count = val_count;
+		void *wval;
+
+		if (!val_count)
+			return -EINVAL;
+
+		wval = kmemdup(val, val_count * val_bytes, map->alloc_flags);
+		if (!wval)
+			return -ENOMEM;
+
+		for (i = 0; i < val_count * val_bytes; i += val_bytes)
+			map->format.parse_inplace(wval + i);
 
 		if (!map->use_single_write) {
 			chunk_size = map->max_raw_write;
@@ -2019,7 +2030,7 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
 		for (i = 0; i < chunk_count; i++) {
 			ret = _regmap_raw_write(map,
 						reg + (i * chunk_stride),
-						val + (i * chunk_size),
+						wval + (i * chunk_size),
 						chunk_size);
 			if (ret)
 				break;
@@ -2028,10 +2039,12 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
 		/* Write remaining bytes */
 		if (!ret && chunk_size * i < total_size) {
 			ret = _regmap_raw_write(map, reg + (i * chunk_stride),
-						val + (i * chunk_size),
+						wval + (i * chunk_size),
 						total_size - i * chunk_size);
 		}
 		map->unlock(map->lock_arg);
+
+		kfree(wval);
 	} else {
 		void *wval;
 
-- 
2.11.0