Received: by 2002:a05:6a10:1a4d:0:0:0:0 with SMTP id nk13csp2733933pxb; Thu, 3 Feb 2022 13:04:30 -0800 (PST) X-Google-Smtp-Source: ABdhPJxt//cL69pG+u69I67DZN84Cr6Go90d/WYyMDF6asLICsB2PuqlVHy6BXMmvj4N39jkcoAg X-Received: by 2002:a17:902:7848:: with SMTP id e8mr6462pln.90.1643922270607; Thu, 03 Feb 2022 13:04:30 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643922270; cv=none; d=google.com; s=arc-20160816; b=XQx9Uq2r7lUsBr7iezhUvdhaJp6D9UpZU/NwKSbqCn/nLL3McLZz3rKI5siCKE6Qfa oul0U9RypalXwCMNK3Ni5933aLcmi4FctZae8/5g4AAQsbDsLVyKzcxvrmdk8snH3e21 4UUqA7E4Ie0tNdHk83+sT6ZpJsswQfgkS8g+hHda0ssY7ak8C1py14ccBVXHKDD30dlk LzhL7Pq/lNeQhp3qH4qGGX0GcDrEoVr7zgo7sjIJSpnXpCM2jTQqIjDnyhdHgTA6klBr lZK/x7PxXsbW59WFGcJyfbX+0MfNbWpMWljBEwCTh8pscN7aNTLwf2VKrbgDiOcHxCMf Ai2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :date:dkim-signature; bh=v5Jk2Zg/jlnzRSMuz3x0o8u6pgBwywiIWqNlylIDzik=; b=Zsio1m279256qkGWvnl3qBeE/RyMCLkMSsTHZU4V92kq8MJ15e5PCD6W6mF8gmSxM4 7tLLu0x0Gp3lfM8XMHebhbRsm4xAf+a66kH3wdmbQt0HrEoGiMJSPHToyNseVbLTkyBK bs3EO0SQONocm+AVHSMmxFu/VB4tBYcbbNeXO0yB1zcSZFHYTOMyYhdSm7Sfm6a096Zv m5O2yHbFEdMKa3jt1H+1oAbupwqNhHky26037ARIMuT4NdmGU5QJpCO/nobD+JOh8e6L N2WUC+cd2/AS71gN0BLkw0nkftd+GoI855TOz+wAix41a2BGa7YF4iEeunLXx2IXJX3k UVFA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@bootlin.com header.s=gm1 header.b=FJP4qh95; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=bootlin.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ik9si20671566plb.190.2022.02.03.13.04.17; Thu, 03 Feb 2022 13:04:30 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@bootlin.com header.s=gm1 header.b=FJP4qh95; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=bootlin.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241170AbiBCJrC (ORCPT + 99 others); Thu, 3 Feb 2022 04:47:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49716 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232632AbiBCJrA (ORCPT ); Thu, 3 Feb 2022 04:47:00 -0500 Received: from relay12.mail.gandi.net (relay12.mail.gandi.net [IPv6:2001:4b98:dc4:8::232]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 36AE4C061714 for ; Thu, 3 Feb 2022 01:47:00 -0800 (PST) Received: (Authenticated sender: miquel.raynal@bootlin.com) by relay12.mail.gandi.net (Postfix) with ESMTPSA id 3923C200018; Thu, 3 Feb 2022 09:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1643881618; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=v5Jk2Zg/jlnzRSMuz3x0o8u6pgBwywiIWqNlylIDzik=; b=FJP4qh95Kbu7zw26XluYKyrhAzkUwwlYyfNwTNiNcTTqTP8F/XXU35UWacDuPTJjweoYEL GiYjvWHc3hP69mR6Nd8Y0X0WY1MhVMAE0YigfhdKbkDTFm6Yu3ty06aWvtNuFAP7d/DjX7 07kNGOCCR7yu9HNPPsuBlqObJA+bm99wZDIvMY+LYOn7+NsuVHHfCklCayId2CpF6Y4Z7q CyRux8QYr/Z54JvD/4L9g9CK7j7Dvj1objxwbKHwaSMbZC9vELYTo7Un6BxICoGvKpQ3// pVIe7usTj7Dk0FeyvXGdhXTmYPjK4+X/EGYWZzhO1tyN32ChRI3QEgTDofZlSg== Date: Thu, 3 Feb 2022 10:46:54 +0100 From: Miquel Raynal To: Richard Weinberger Cc: =?UTF-8?B?TWljaGHFgiBLxJlwaWXFhA==?= , Vignesh Raghavendra , Boris Brezillon , linux-mtd , linux-kernel Subject: Re: [PATCH v3 4/4] mtdchar: add MEMREAD ioctl Message-ID: <20220203104654.6cb43ea3@xps13> In-Reply-To: <1173246756.12597.1643879936765.JavaMail.zimbra@nod.at> References: <20220125104822.8420-1-kernel@kempniu.pl> <20220125104822.8420-5-kernel@kempniu.pl> <1173246756.12597.1643879936765.JavaMail.zimbra@nod.at> Organization: Bootlin X-Mailer: Claws Mail 3.17.7 (GTK+ 2.24.32; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Richard, richard@nod.at wrote on Thu, 3 Feb 2022 10:18:56 +0100 (CET): > Micha=C5=82, >=20 > ----- Urspr=C3=BCngliche Mail ----- > > Von: "Micha=C5=82 K=C4=99pie=C5=84" > > An: "Miquel Raynal" , "richard" , "Vignesh Raghavendra" > > CC: "Boris Brezillon" , "linux-mtd" , "linux-kernel" > > > > Gesendet: Dienstag, 25. Januar 2022 11:48:22 > > Betreff: [PATCH v3 4/4] mtdchar: add MEMREAD ioctl =20 >=20 > > + if (req.start + req.len > mtd->size) { =20 >=20 > I think this can overflow since both req.start and req.len are u64. > So an evil-doer might bypass this check. >=20 > > + ret =3D -EINVAL; > > + goto out; > > + } > > + > > + datbuf_len =3D min_t(size_t, req.len, mtd->erasesize); > > + if (datbuf_len > 0) { > > + datbuf =3D kmalloc(datbuf_len, GFP_KERNEL); =20 >=20 > If mtd->erasesize is large (which is not uncommon these days) you might > request more from kmalloc() than it can serve. > Maybe kvmalloc() makes more sense? Mmmh, I would really like these buffers dma-able. I just discovered mtd_kmalloc_up_to(). Would this work? >=20 > > + if (!datbuf) { > > + ret =3D -ENOMEM; > > + goto out; > > + } > > + } > > + > > + oobbuf_len =3D min_t(size_t, req.ooblen, mtd->erasesize); > > + if (oobbuf_len > 0) { > > + oobbuf =3D kmalloc(oobbuf_len, GFP_KERNEL); =20 >=20 > Same. >=20 > Thanks, > //richard Thanks, Miqu=C3=A8l