Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6f0f818 authored by David Woodhouse's avatar David Woodhouse
Browse files

[MTD] [NOR] Fix overflow check in jedec_probe 



Having laid the code out so that it's easier to read instead of sticking
to the 80-column guideline even when it doesn't make sense, a bug is
immediately spotted... we were only checking _one_ of the unlock
addresses to see if it runs off the end of the map.

Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
parent 5d3cce3b

drivers/mtd/chips/jedec_probe.c

+1 −1
Original line number Diff line number Diff line
@@ -1952,7 +1952,7 @@ static int jedec_probe_chip(struct map_info *map, __u32 base, 
	}

	/* Ensure the unlock addresses we try stay inside the map */

	probe_offset1 = cfi_build_cmd_addr(cfi->addr_unlock1, cfi_interleave(cfi), cfi->device_type);

	probe_offset2 = cfi_build_cmd_addr(cfi->addr_unlock1, cfi_interleave(cfi), cfi->device_type);

	probe_offset2 = cfi_build_cmd_addr(cfi->addr_unlock2, cfi_interleave(cfi), cfi->device_type);

	if (	((base + probe_offset1 + map_bankwidth(map)) >= map->size) ||

		((base + probe_offset2 + map_bankwidth(map)) >= map->size))

		goto retry;