Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 30 Nov 2017 15:09:15 +0100
From:   Krzysztof Adamski <krzysztof.adamski@nokia.com>
To:     Mark Brown <broonie@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-kernel@vger.kernel.org
Subject: [PATCH] regmap: use proper part of work_buf for storing val
Message-ID: <20171130140913.GA16598@localhost.localdomain>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
User-Agent: Mutt/1.9.1 (2017-09-22)
Received-SPF: None (protection.outlook.com: nokia.com does not designate
 permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Nov 2017 14:09:22.5322 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 7cf3e6d4-6d45-4242-18d1-08d537fbf4ce
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 5d471751-9675-428d-917b-70f44f9630b0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0702MB3790
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The map->work_buf is a buffer preallocated in __regmap_init() with size
allowing it to store all 3 parts of a buffer - reg, pad and val. While
reg and val parts are always properly setup before each transaction, the
pad part is left at its default value (zeros). Until it is overwritten,
that is.

_regmap_bus_read(), when calling _regmap_raw_read() uses beginning of
work_buf as a place to store data read. Usually that is fine but if
val_bits > reg_bits && pad_bits > 0, padding area of work_buf() may get
overwritten. Since padding is not zeroed before each transaction,
garbage will be used on next calls.

This patch moves the val pointer used for _regmap_raw_read() to point
to a part of work_buf intended for storing value read.

Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
---
 drivers/base/regmap/regmap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index b9a779a4a739..d8806eac2708 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -2344,13 +2344,15 @@ static int _regmap_bus_read(void *context, unsigned int reg,
 {
 	int ret;
 	struct regmap *map = context;
+	void *work_val = map->work_buf + map->format.reg_bytes +
+		map->format.pad_bytes;
 
 	if (!map->format.parse_val)
 		return -EINVAL;
 
-	ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);
+	ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes);
 	if (ret == 0)
-		*val = map->format.parse_val(map->work_buf);
+		*val = map->format.parse_val(work_val);
 
 	return ret;
 }
-- 
2.13.6


From 1585502563428038596@xxx Thu Nov 30 14:44:33 +0000 2017
X-GM-THRID: 1579079324433647108
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread