linux-kernel - Re: [PATCH] regmap: spi: Reserve space for register address/padding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 18 Aug 2022 13:53:14 +0300
From:   Cristian Ciocaltea <cristian.ciocaltea@...labora.com>
To:     Lucas tanure <tanureal@...nsource.cirrus.com>,
        Mark Brown <broonie@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        André Almeida <andrealmeid@...lia.com>,
        Charles Keepax <ckeepax@...nsource.cirrus.com>
Cc:     linux-kernel@...r.kernel.org, kernel@...labora.com
Subject: Re: [PATCH] regmap: spi: Reserve space for register address/padding


On 8/18/22 12:22, Lucas tanure wrote:
> On 8/17/22 22:38, Cristian Ciocaltea wrote:
>> Currently the max_raw_read and max_raw_write limits in regmap_spi struct
>> do not take into account the additional size of the transmitted register
>> address and padding.  This may result in exceeding the maximum permitted
>> SPI transfer size, which could cause undefined behaviour, e.g. data
>> corruption.
>>
>> Fix regmap_get_spi_bus() to properly adjust the above mentioned limits
>> by reserving space for the register address/padding as set in the regmap
>> configuration.
>>
>> Fixes: f231ff38b7b2 ("regmap: spi: Set regmap max raw r/w from 
>> max_transfer_size")
>>
>> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@...labora.com>
>> ---
>>   drivers/base/regmap/regmap-spi.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/base/regmap/regmap-spi.c 
>> b/drivers/base/regmap/regmap-spi.c
>> index 719323bc6c7f..6fb94c06a447 100644
>> --- a/drivers/base/regmap/regmap-spi.c
>> +++ b/drivers/base/regmap/regmap-spi.c
>> @@ -113,6 +113,7 @@ static const struct regmap_bus 
>> *regmap_get_spi_bus(struct spi_device *spi,
>>                              const struct regmap_config *config)
>>   {
>>       size_t max_size = spi_max_transfer_size(spi);
>> +    size_t max_msg_size, reg_reserve_size;
>>       struct regmap_bus *bus;
>>
>>       if (max_size != SIZE_MAX) {
>> @@ -120,9 +121,15 @@ static const struct regmap_bus 
>> *regmap_get_spi_bus(struct spi_device *spi,
>>           if (!bus)
>>               return ERR_PTR(-ENOMEM);
>>
>> +        max_msg_size = spi_max_message_size(spi);
>> +        reg_reserve_size = config->reg_bits / 8 + config->pad_bits / 8;
> I think you can use BITS_PER_BYTE here instead of 8.

Right, thanks for hint. Applied to v2:

https://lore.kernel.org/all/20220818104851.429479-1-cristian.ciocaltea@collabora.com/

>> +        if (max_size + reg_reserve_size > max_msg_size)
>> +            max_size -= reg_reserve_size;
>> +
>>           bus->free_on_exit = true;
>>           bus->max_raw_read = max_size;
>>           bus->max_raw_write = max_size;
>> +
>>           return bus;
>>       }
>>
>> base-commit: 568035b01cfb107af8d2e4bd2fb9aea22cf5b868
>> -- 
>> 2.37.2
>