lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 13 May 2022 12:41:42 +0800 From: Tzung-Bi Shih <tzungbi@...nel.org> To: bleung@...omium.org, groeck@...omium.org Cc: chrome-platform@...ts.linux.dev, tzungbi@...nel.org, linux-kernel@...r.kernel.org Subject: [PATCH v2 6/7] platform/chrome: cros_ec_spi: drop unneeded BUG_ON() In the context, the following conditions are always false: - `todo` < 0 Suppose that EC_SPI_FRAME_START is found at the last byte of transfer. In the case, `ptr` == `end` - 1. As a result, `todo` must be 0. - `todo` > `ec_dev->din_size` Suppose that there is no preamble bytes. EC_SPI_FRAME_START is found at the first byte of transfer. In the case, `end` == `ptr` + EC_MSG_PREAMBLE_COUNT. As a result, `todo` == EC_MSG_PREAMBLE_COUNT - 1. However, it already checked `ec_dev->din_size` < EC_MSG_PREAMBLE_COUNT at the beginning of function. Drop the unneeded BUG_ON(). Signed-off-by: Tzung-Bi Shih <tzungbi@...nel.org> --- Changes from v1: - Separate from the original 6th patch. - Drop the BUG_ON() instead of returning -EINVAL. drivers/platform/chrome/cros_ec_spi.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/platform/chrome/cros_ec_spi.c b/drivers/platform/chrome/cros_ec_spi.c index 589f18e9537d..5264615f46af 100644 --- a/drivers/platform/chrome/cros_ec_spi.c +++ b/drivers/platform/chrome/cros_ec_spi.c @@ -237,7 +237,6 @@ static int cros_ec_spi_receive_packet(struct cros_ec_device *ec_dev, * start of our buffer */ todo = end - ++ptr; - BUG_ON(todo < 0 || todo > ec_dev->din_size); todo = min(todo, need_len); memmove(ec_dev->din, ptr, todo); ptr = ec_dev->din + todo; @@ -345,7 +344,6 @@ static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev, * start of our buffer */ todo = end - ++ptr; - BUG_ON(todo < 0 || todo > ec_dev->din_size); todo = min(todo, need_len); memmove(ec_dev->din, ptr, todo); ptr = ec_dev->din + todo; -- 2.36.0.550.gb090851708-goog
Powered by blists - more mailing lists