Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9989c022 authored by Peng Fan's avatar Peng Fan Committed by Greg Kroah-Hartman
Browse files

regmap: debugfs: check count when read regmap file 



commit 74edd08a4fbf51d65fd8f4c7d8289cd0f392bd91 upstream.

When executing the following command, we met kernel dump.
dmesg -c > /dev/null; cd /sys;
for i in `ls /sys/kernel/debug/regmap/* -d`; do
	echo "Checking regmap in $i";
	cat $i/registers;
done && grep -ri "0x02d0" *;

It is because the count value is too big, and kmalloc fails. So add an
upper bound check to allow max size `PAGE_SIZE << (MAX_ORDER - 1)`.

Signed-off-by: default avatarPeng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/1584064687-12964-1-git-send-email-peng.fan@nxp.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ddb5bba4

drivers/base/regmap/regmap-debugfs.c

+6 −0
Original line number Diff line number Diff line
@@ -209,6 +209,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from, 
	if (*ppos < 0 || !count)

		return -EINVAL;



	if (count > (PAGE_SIZE << (MAX_ORDER - 1)))

		count = PAGE_SIZE << (MAX_ORDER - 1);



	buf = kmalloc(count, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;
@@ -357,6 +360,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file, 
	if (*ppos < 0 || !count)

		return -EINVAL;



	if (count > (PAGE_SIZE << (MAX_ORDER - 1)))

		count = PAGE_SIZE << (MAX_ORDER - 1);



	buf = kmalloc(count, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;