mtd: mtdram: check offs and len in mtdram->erase
authorDongsheng Yang <yangds.fnst@cn.fujitsu.com>
Tue, 21 Jul 2015 08:30:20 +0000 (16:30 +0800)
committerBrian Norris <computersforpeace@gmail.com>
Tue, 29 Sep 2015 22:43:15 +0000 (15:43 -0700)
We should prevent user to erasing mtd device with
an unaligned offset or length.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
drivers/mtd/devices/mtdram.c

index 8e285089229c364ee29c6b4f7c90a872d6e7c693..73fa297d81d222d70e1309bf4f0f031dd723c3fe 100644 (file)
@@ -32,8 +32,29 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB");
 // We could store these in the mtd structure, but we only support 1 device..
 static struct mtd_info *mtd_info;
 
+static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+       int ret = 0;
+
+       /* Start address must align on block boundary */
+       if (ofs % mtd->erasesize) {
+               pr_debug("%s: unaligned address\n", __func__);
+               ret = -EINVAL;
+       }
+
+       /* Length must align on block boundary */
+       if (len % mtd->erasesize) {
+               pr_debug("%s: length not block aligned\n", __func__);
+               ret = -EINVAL;
+       }
+
+       return ret;
+}
+
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
+       if (check_offs_len(mtd, instr->addr, instr->len))
+               return -EINVAL;
        memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
        instr->state = MTD_ERASE_DONE;
        mtd_erase_callback(instr);