linux-kernel - Re: [PATCH] regmap: spi: Reserve space for register address/padding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d21568e5-854b-0a3e-f71d-947198aa61a5@opensource.cirrus.com>
Date:   Thu, 18 Aug 2022 10:22:03 +0100
From:   Lucas tanure <tanureal@...nsource.cirrus.com>
To:     Cristian Ciocaltea <cristian.ciocaltea@...labora.com>,
        Mark Brown <broonie@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        André Almeida <andrealmeid@...lia.com>,
        Charles Keepax <ckeepax@...nsource.cirrus.com>
CC:     <linux-kernel@...r.kernel.org>, <kernel@...labora.com>
Subject: Re: [PATCH] regmap: spi: Reserve space for register address/padding

On 8/17/22 22:38, Cristian Ciocaltea wrote:
> Currently the max_raw_read and max_raw_write limits in regmap_spi struct
> do not take into account the additional size of the transmitted register
> address and padding.  This may result in exceeding the maximum permitted
> SPI transfer size, which could cause undefined behaviour, e.g. data
> corruption.
> 
> Fix regmap_get_spi_bus() to properly adjust the above mentioned limits
> by reserving space for the register address/padding as set in the regmap
> configuration.
> 
> Fixes: f231ff38b7b2 ("regmap: spi: Set regmap max raw r/w from max_transfer_size")
> 
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@...labora.com>
> ---
>   drivers/base/regmap/regmap-spi.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
> index 719323bc6c7f..6fb94c06a447 100644
> --- a/drivers/base/regmap/regmap-spi.c
> +++ b/drivers/base/regmap/regmap-spi.c
> @@ -113,6 +113,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi,
>   						   const struct regmap_config *config)
>   {
>   	size_t max_size = spi_max_transfer_size(spi);
> +	size_t max_msg_size, reg_reserve_size;
>   	struct regmap_bus *bus;
> 
>   	if (max_size != SIZE_MAX) {
> @@ -120,9 +121,15 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi,
>   		if (!bus)
>   			return ERR_PTR(-ENOMEM);
> 
> +		max_msg_size = spi_max_message_size(spi);
> +		reg_reserve_size = config->reg_bits / 8 + config->pad_bits / 8;
I think you can use BITS_PER_BYTE here instead of 8.

> +		if (max_size + reg_reserve_size > max_msg_size)
> +			max_size -= reg_reserve_size;
> +
>   		bus->free_on_exit = true;
>   		bus->max_raw_read = max_size;
>   		bus->max_raw_write = max_size;
> +
>   		return bus;
>   	}
> 
> base-commit: 568035b01cfb107af8d2e4bd2fb9aea22cf5b868
> --
> 2.37.2