linux-kernel - Re: [PATCH v2] regmap: spi: Reserve space for register address/padding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3929af86-b427-a745-984d-9a9b9ab17337@opensource.cirrus.com>
Date:   Thu, 18 Aug 2022 14:03:49 +0100
From:   Lucas tanure <tanureal@...nsource.cirrus.com>
To:     Cristian Ciocaltea <cristian.ciocaltea@...labora.com>,
        Mark Brown <broonie@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        André Almeida <andrealmeid@...lia.com>,
        Charles Keepax <ckeepax@...nsource.cirrus.com>
CC:     <linux-kernel@...r.kernel.org>, <kernel@...labora.com>
Subject: Re: [PATCH v2] regmap: spi: Reserve space for register
 address/padding

On 8/18/22 11:48, Cristian Ciocaltea wrote:
> Currently the max_raw_read and max_raw_write limits in regmap_spi struct
> do not take into account the additional size of the transmitted register
> address and padding.  This may result in exceeding the maximum permitted
> SPI message size, which could cause undefined behaviour, e.g. data
> corruption.
> 
> Fix regmap_get_spi_bus() to properly adjust the above mentioned limits
> by reserving space for the register address/padding as set in the regmap
> configuration.
> 
> Fixes: f231ff38b7b2 ("regmap: spi: Set regmap max raw r/w from max_transfer_size")
> 
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@...labora.com>
Reviewed-by: Lucas Tanure <tanureal@...nsource.cirrus.com>
> ---
> Changes in v2:
>   - Make use of BITS_PER_BYTE, as suggested by Lucas
>   - Small correction in the commit message
> 
>   drivers/base/regmap/regmap-spi.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
> index 719323bc6c7f..37ab23a9d034 100644
> --- a/drivers/base/regmap/regmap-spi.c
> +++ b/drivers/base/regmap/regmap-spi.c
> @@ -113,6 +113,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi,
>   						   const struct regmap_config *config)
>   {
>   	size_t max_size = spi_max_transfer_size(spi);
> +	size_t max_msg_size, reg_reserve_size;
>   	struct regmap_bus *bus;
>   
>   	if (max_size != SIZE_MAX) {
> @@ -120,9 +121,16 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi,
>   		if (!bus)
>   			return ERR_PTR(-ENOMEM);
>   
> +		max_msg_size = spi_max_message_size(spi);
> +		reg_reserve_size = config->reg_bits / BITS_PER_BYTE
> +				 + config->pad_bits / BITS_PER_BYTE;
> +		if (max_size + reg_reserve_size > max_msg_size)
> +			max_size -= reg_reserve_size;
> +
>   		bus->free_on_exit = true;
>   		bus->max_raw_read = max_size;
>   		bus->max_raw_write = max_size;
> +
>   		return bus;
>   	}
>   
> 
> base-commit: 568035b01cfb107af8d2e4bd2fb9aea22cf5b868