From: Sascha Hauer <sha@pengutronix.de> To: Ahmad Fatoum <ahmad@a3f.at> Cc: barebox@lists.infradead.org Subject: Re: [PATCH master] fs: /dev/mem: handle copy at offset 0 correctly Date: Tue, 7 Dec 2021 10:13:05 +0100 [thread overview] Message-ID: <20211207091305.GL28260@pengutronix.de> (raw) In-Reply-To: <20211129071454.2014315-1-ahmad@a3f.at> On Mon, Nov 29, 2021 at 08:14:54AM +0100, Ahmad Fatoum wrote: > Despite that /dev/mem has a size of 0, the check preventing > out-of-bounds access works for /dev/mem as well, because of unsigned > wrap around. Corner case is when offset is zero. There will be no wrap > around and > > count = min(count, 0 - 0) = 0 > > Leading to unexpected behavior with e.g. > > memcmp -s /dev/mem 0 > > on systems without MMU. Fix this. > > Signed-off-by: Ahmad Fatoum <ahmad@a3f.at> > --- > fs/devfs-core.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) Applied, thanks Sascha > > diff --git a/fs/devfs-core.c b/fs/devfs-core.c > index 3715e543e632..2d016e0e4861 100644 > --- a/fs/devfs-core.c > +++ b/fs/devfs-core.c > @@ -573,7 +573,10 @@ ssize_t mem_copy(struct device_d *dev, void *dst, const void *src, > if (!dev || dev->num_resources < 1) > return -1; > > - count = size = min(count, resource_size(&dev->resource[0]) - offset); > + if (resource_size(&dev->resource[0]) > 0 || offset != 0) > + count = min(count, resource_size(&dev->resource[0]) - offset); > + > + size = count; > > /* no rwsize specification given. Do whatever memcpy likes best */ > if (!rwsize) { > -- > 2.33.0 > > > _______________________________________________ > barebox mailing list > barebox@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/barebox > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ barebox mailing list barebox@lists.infradead.org http://lists.infradead.org/mailman/listinfo/barebox
prev parent reply other threads:[~2021-12-07 9:16 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-11-29 7:14 Ahmad Fatoum 2021-12-07 9:13 ` Sascha Hauer [this message]
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20211207091305.GL28260@pengutronix.de \ --to=sha@pengutronix.de \ --cc=ahmad@a3f.at \ --cc=barebox@lists.infradead.org \ --subject='Re: [PATCH master] fs: /dev/mem: handle copy at offset 0 correctly' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox