linux/drivers/base
Laxman Dewangan 6560ffd1cc regmap: fix possible memory corruption in regmap_bulk_read()
The function regmap_bulk_read() calls the regmap_read() for
each register if set of register has volatile and cache is
enabled. In this case, last few register read makes the memory
corruption if the register size is not the size of unsigned int.
The regam_read() takes argument as unsigned int for returning
value and it update the value as
	*val = map->format.parse_val(map->work_buf);
This causes complete 4 bytes (size of unsigned int) to get written.
Now if client pass the memory pointer for value which is equal to the
required size of register count in regmap_bulk_read() then last few
register read actually update the memory beyond passed pointer size.

Avoid this by using local variable for read and then do memcpy()
for actual byte copy to passed pointer based on register size.

I allocated one pointer ptr and take first 16 bytes dump of that
pointer then call regmap_bulk_read() with pointer which is just
on top of this allocated pointer and register count of 128. Here
register size is 1 byte.
The memory trace of last 5 register read are as follows:

[    5.438589] regmap_bulk_read after regamp_read() for register 122
[    5.447421] 0xef993c20 0xef993c00 0x00000000 0x00000001
[    5.467535] regmap_bulk_read after regamp_read() for register 123
[    5.476374] 0xef993c20 0xef993c00 0x00000000 0x00000001
[    5.496425] regmap_bulk_read after regamp_read() for register 124
[    5.505260] 0xef993c20 0xef993c00 0x00000000 0x00000001
[    5.525372] regmap_bulk_read after regamp_read() for register 125
[    5.534205] 0xef993c00 0xef993c00 0x00000000 0x00000001
[    5.554258] regmap_bulk_read after regamp_read() for register 126
[    5.563100] 0xef990000 0xef993c00 0x00000000 0x00000001
[    5.554258] regmap_bulk_read after regamp_read() for register 127
[    5.587108] 0xef000000 0xef993c00 0x00000000 0x00000001

Here it is observed that the memory content at first word started changing
on last 3 regmap_read() and so corruption happened.

Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-05-09 15:44:11 +01:00
..
power PM / Runtime: don't forget to wake up waitqueue on failure 2012-03-26 22:46:52 +02:00
regmap regmap: fix possible memory corruption in regmap_bulk_read() 2012-05-09 15:44:11 +01:00
attribute_container.c [SCSI] attirbute_container: Initialize sysfs attributes with sysfs_attr_init 2010-03-27 15:15:24 -04:00
base.h driver core: move the deferred probe pointer into the private area 2012-03-08 12:17:22 -08:00
bus.c Merge 3.3-rc2 into the driver-core-next branch. 2012-02-02 11:24:44 -08:00
class.c driver-core: implement 'sysdev' functionality for regular devices and buses 2011-12-14 14:29:38 -08:00
core.c Core device tree changes for Linux v3.4 2012-03-21 10:30:03 -07:00
cpu.c Merge 3.3-rc6 into driver-core-next 2012-03-09 12:35:53 -08:00
dd.c driver core: minor comment formatting cleanups 2012-03-08 12:20:37 -08:00
devres.c devres: Fix a typo in devm_kfree comment 2011-12-21 00:31:47 +01:00
devtmpfs.c Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-01-08 12:19:57 -08:00
dma-buf.c dma-buf: add support for kernel cpu access 2012-03-26 11:33:02 +05:30
dma-coherent.c drivers/base: dma-coherent.c is a module and needs module.h 2011-10-31 19:31:38 -04:00
dma-mapping.c drivers/base: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required. 2011-10-31 19:31:38 -04:00
driver.c Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2012-03-21 18:55:10 -07:00
firmware.c
firmware_class.c firmware_class: Move request_firmware_nowait() to workqueues 2012-03-28 23:31:00 +02:00
hypervisor.c drivers/base: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required. 2011-10-31 19:31:38 -04:00
init.c driver-core: implement 'sysdev' functionality for regular devices and buses 2011-12-14 14:29:38 -08:00
isa.c dma-mapping: replace all DMA_24BIT_MASK macro with DMA_BIT_MASK(24) 2009-04-07 08:31:12 -07:00
Kconfig drivers/base: add bus for System-on-Chip devices 2012-02-10 11:42:25 -08:00
Makefile drivers/base: add bus for System-on-Chip devices 2012-02-10 11:42:25 -08:00
map.c
memory.c Linux 3.3-rc7 2012-03-14 07:44:11 +01:00
module.c driver core: module.c: Use kasprintf 2010-05-21 09:37:29 -07:00
node.c drivers/base/memory.c: fix memory_dev_init() long delay 2012-02-02 15:50:05 -08:00
platform.c drivercore: Output common devicetree information in uevent 2012-02-01 14:26:30 -07:00
soc.c drivers/base: fix compiler warning in SoC export driver - idr should be ida 2012-04-09 14:54:22 -07:00
syscore.c PM: Reintroduce dropped call to check_wakeup_irqs 2011-07-11 10:51:49 +02:00
topology.c cpu: convert 'cpu' and 'machinecheck' sysdev_class to a regular subsystem 2011-12-21 14:29:42 -08:00
transport_class.c drivers/base: transport_class explicitly requires EXPORT_SYMBOL 2011-10-31 19:31:15 -04:00