Date:   Thu, 9 Dec 2021 17:35:01 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Benson Leung <bleung@chromium.org>,
        Bill Richardson <wfrichar@chromium.org>
Cc:     Guenter Roeck <groeck@chromium.org>,
        Javier Martinez Canillas <javier@osg.samsung.com>,
        Olof Johansson <olof@lixom.net>,
        Gwendal Grignou <gwendal@chromium.org>,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] platform/chrome: cros_ec: fix read overflow in
 cros_ec_lpc_readmem()
Message-ID: <20211209143501.GA3041@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?gYSRau7h3Vcpqp8S6sNaLB2pjibkI/lzqnZ0oqmWc57gy3QI6kYJdARJxIqp?=
 =?us-ascii?Q?JzDcGwvsv1Q3xV61SuWsa6yLF18U+PQHEIlkf9Kj2TJhqEuHNFL5dJIhl7c7?=
 =?us-ascii?Q?OyGSaTFc0tZMQEMNqJZI83GmIp8IK+MQe6mgDw9UeiV/JfdH8u/0kiKk7DSA?=
 =?us-ascii?Q?whbh9/txPKw92QLHETuTFPGTxeGC3ZccqiEnp8Ud2hOpCrz/7KNPrw9oG8/S?=
 =?us-ascii?Q?8CY6eps/4jhVCJVm4sZVzsNXKN6mRZoh3rIEpvx4pW2idNGIQejQlTvRz9Dr?=
 =?us-ascii?Q?Q3lzdohh/1fBquajbKL4bWwUCGbzGhU44Az2Nep8p9SOl/kr40A2jmkQsl4z?=
 =?us-ascii?Q?6f9SYEQLuBDnA5GTfuGL6PnK0CtXGckK7274ZCcyveKZOv5dIauNPc2Z/EtU?=
 =?us-ascii?Q?vu6VG+Isqbj24JibwMVUnSQg3gE65JpW2PvZt7KFGj5mpDp02LvjZyrRME/m?=
 =?us-ascii?Q?rl3ryJ6aBPYkB+q4BnC95zYsb4lty4Md6n84E+Kp5yqowRdR6uPFOWih4w3k?=
 =?us-ascii?Q?I5YgeOmg1tMuW1btyUW5klGkMauTgvzSnJVnL/Hkr9Ym8pgtCZ+vVffOJHs0?=
 =?us-ascii?Q?NOcQsYdY4KNUmpj9oL7uxELGo3M+QD1S9CyoFuo+NkQ0QjEYKs7MXVmxzqwQ?=
 =?us-ascii?Q?9l8fdk2e6ycGpdhC7q5Id05X0yOdB6PL7PtXzCDWeTXkbRBobxFIFHA0Oi90?=
 =?us-ascii?Q?nCLZQe6oljroO63RxsKTdS7TFBC9VliZEju4BMTVXoWBXwCA1pF36HiMm/ys?=
 =?us-ascii?Q?ntL2+Gk5dTAS9FkS5dEN+COobY9vTsOLqz5BleHoKEoCSroyljoS7nDBhqES?=
 =?us-ascii?Q?SVy8CXMAkEDAoBIA/rX4UTCG+4X/9WPdVdkYjrIez9NEycwC5TXy0hles7bd?=
 =?us-ascii?Q?RLek2JSFCRmDKoKZtKCcZQjxcn2LMezp+gIkU/05LrcAHvVHKtcXF6wWaO2A?=
 =?us-ascii?Q?0B3ep4fYOURsIQ6lr/fvRwkqTJlzbhEYhJS0MP0G83jn4ucEF92mXVZyAd5R?=
 =?us-ascii?Q?XoCpoUiqQMPPa6icFQYLCtGy/bUXHLJNvglvmJCYtvyPrJcfYaERE1PD3mu8?=
 =?us-ascii?Q?Qc/I3c3asHRR0gH6uDlXuXVVn7kis9q9SRTboJID2x8TAsirmc7rs+EPzor5?=
 =?us-ascii?Q?wSIYCbE60XGwMKab/nRFUlgjU0y/+yJGUW62zr7KCmfDqblCfFKGyKdOxvjU?=
 =?us-ascii?Q?yDWWhLE5zBQQK+9Ik3dQKsk2XxKnRTujiloSgB0GMQN9ETrIDI+cRn8nUiNV?=
 =?us-ascii?Q?gt7F5qMAw/04nReqPr+E6TVuFh8ppeCFyfbYyIdrWykr0Z811zArtSnOII+R?=
 =?us-ascii?Q?Or6I8O4oiPwa2O7DWQWg0HFs+bRenjx6DbX3ZiH9pnkIowUSBuOmVstsAZdR?=
 =?us-ascii?Q?ymbWS7Mhgj0cMWVMRe+lYdCIMusx4HJiMoKfk7tSbqumYfuaWGjshbqDdTr0?=
 =?us-ascii?Q?4QReQIk89GG9ngfpgDa08gBcElLEUAU+7IcLx8ND6+GsInRQb9yiaGf0JQoS?=
 =?us-ascii?Q?saJGLFDYCS4Q4lXFeC0O4RVKfg5Buohqdp/mBk9kZTUwIj+XuWsMPpcTrkHt?=
 =?us-ascii?Q?/wo8An0YAOiQw97M2DRnQK1aq9d+POuQ5eNTJG2HcCmnqltzw0lOFOWfiYSp?=
 =?us-ascii?Q?MN7M1ER+WhELWQtAqNDeSCdEFYa7kr1+Q6SNOobE1ol6CGszNKwR540vIJ1R?=
 =?us-ascii?Q?f+rSiQPgnPpWFS99t9wF1Y4E/Ym7eCwsY7GMG71sD3NeGjc+?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5ff7d65e-012d-4874-46ad-08d9bb211d53
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Dec 2021 14:35:15.1736
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: QNjhPHj02Hpw/aBKdV/JIUWDN/Bwr3mdPvwTiEH86Vfy8zIxRZ79L7NzyblscWo5emP0UdIYK7qamtAWaxxIG8LDo5RlP51udm4Z+mBGskA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1001MB2397
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10192 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 phishscore=0
 malwarescore=0 spamscore=0 mlxlogscore=999 adultscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112090078
X-Proofpoint-GUID: LGZleoGPwEFZE1EsY_gVBM7ySZNLoTo4
X-Proofpoint-ORIG-GUID: LGZleoGPwEFZE1EsY_gVBM7ySZNLoTo4
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

If bytes is larger than EC_MEMMAP_SIZE (255) then "EC_MEMMAP_SIZE -
bytes" is a very high unsigned value and basically offset is
accepted.  The second problem is that it uses >= instead of > so this
means that we are not able to read the very last byte.

Fixes: ec2f33ab582b ("platform/chrome: Add cros_ec_lpc driver for x86 devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/platform/chrome/cros_ec_lpc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index d6306d2a096f..7e1d175def9f 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -290,7 +290,8 @@ static int cros_ec_lpc_readmem(struct cros_ec_device *ec, unsigned int offset,
 	char *s = dest;
 	int cnt = 0;
 
-	if (offset >= EC_MEMMAP_SIZE - bytes)
+	if (offset > EC_MEMMAP_SIZE ||
+	    bytes > EC_MEMMAP_SIZE - offset)
 		return -EINVAL;
 
 	/* fixed length */
-- 
2.20.1