mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-14 12:37:32 +00:00
regmap: debugfs: check count when read regmap file
commit 74edd08a4f
upstream.
When executing the following command, we met kernel dump.
dmesg -c > /dev/null; cd /sys;
for i in `ls /sys/kernel/debug/regmap/* -d`; do
echo "Checking regmap in $i";
cat $i/registers;
done && grep -ri "0x02d0" *;
It is because the count value is too big, and kmalloc fails. So add an
upper bound check to allow max size `PAGE_SIZE << (MAX_ORDER - 1)`.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/1584064687-12964-1-git-send-email-peng.fan@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bbacb34b84
commit
1f850ba16f
1 changed files with 6 additions and 0 deletions
|
@ -204,6 +204,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
|
|||
if (*ppos < 0 || !count)
|
||||
return -EINVAL;
|
||||
|
||||
if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
|
||||
count = PAGE_SIZE << (MAX_ORDER - 1);
|
||||
|
||||
buf = kmalloc(count, GFP_KERNEL);
|
||||
if (!buf)
|
||||
return -ENOMEM;
|
||||
|
@ -352,6 +355,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
|
|||
if (*ppos < 0 || !count)
|
||||
return -EINVAL;
|
||||
|
||||
if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
|
||||
count = PAGE_SIZE << (MAX_ORDER - 1);
|
||||
|
||||
buf = kmalloc(count, GFP_KERNEL);
|
||||
if (!buf)
|
||||
return -ENOMEM;
|
||||
|
|
Loading…
Reference in a new issue