Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab84fce5 authored by Dongsheng Yang's avatar Dongsheng Yang Committed by Brian Norris
Browse files

mtd: mtdram: check offs and len in mtdram->erase 



We should prevent user to erasing mtd device with
an unaligned offset or length.

Signed-off-by: default avatarDongsheng Yang <yangds.fnst@cn.fujitsu.com>
Signed-off-by: default avatarBrian Norris <computersforpeace@gmail.com>
parent d3e94f3f

drivers/mtd/devices/mtdram.c

+21 −0
Original line number Diff line number Diff line
@@ -32,8 +32,29 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB"); 
// We could store these in the mtd structure, but we only support 1 device..

static struct mtd_info *mtd_info;



static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)

{

	int ret = 0;



	/* Start address must align on block boundary */

	if (mtd_mod_by_eb(ofs, mtd)) {

		pr_debug("%s: unaligned address\n", __func__);

		ret = -EINVAL;

	}



	/* Length must align on block boundary */

	if (mtd_mod_by_eb(len, mtd)) {

		pr_debug("%s: length not block aligned\n", __func__);

		ret = -EINVAL;

	}



	return ret;

}



static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)

{

	if (check_offs_len(mtd, instr->addr, instr->len))

		return -EINVAL;

	memset((char *)mtd->priv + instr->addr, 0xff, instr->len);

	instr->state = MTD_ERASE_DONE;

	mtd_erase_callback(instr);