mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
To: barebox@lists.infradead.org
Cc: bst@pengutronix.de, Ahmad Fatoum <a.fatoum@pengutronix.de>
Subject: [PATCH 4/4] mtd: fix possible overflow during mtd size multiplication
Date: Wed, 24 Mar 2021 13:22:47 +0100	[thread overview]
Message-ID: <20210324122247.10683-4-a.fatoum@pengutronix.de> (raw)
In-Reply-To: <20210324122247.10683-1-a.fatoum@pengutronix.de>

LGTM[1] flags a couple of places where we write a 32-bit multiplication
result into a 64-bit destination. While it might very well be that
there are more places in need of fixing to support flashes bigger than
4G, fixing these issues is easy and reduces the noise. Do so.

[1]: https://lgtm.com/projects/g/saschahauer/barebox/alerts/?mode=list

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/mtd/core.c            | 2 +-
 drivers/mtd/mtdoob.c          | 2 +-
 drivers/mtd/peb.c             | 4 ++--
 drivers/mtd/spi-nor/spi-nor.c | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/core.c b/drivers/mtd/core.c
index 22eb2a056c4e..37fccda6be27 100644
--- a/drivers/mtd/core.c
+++ b/drivers/mtd/core.c
@@ -131,7 +131,7 @@ static struct mtd_erase_region_info *mtd_find_erase_region(struct mtd_info *mtd,
 
 	for (i = 0; i < mtd->numeraseregions; i++) {
 		struct mtd_erase_region_info *e = &mtd->eraseregions[i];
-		if (offset > e->offset + e->erasesize * e->numblocks)
+		if (offset > e->offset + (loff_t)e->erasesize * e->numblocks)
 			continue;
 		return e;
 	}
diff --git a/drivers/mtd/mtdoob.c b/drivers/mtd/mtdoob.c
index 04e064b227cb..19719c4d6279 100644
--- a/drivers/mtd/mtdoob.c
+++ b/drivers/mtd/mtdoob.c
@@ -77,7 +77,7 @@ static int add_mtdoob_device(struct mtd_info *mtd, const char *devname, void **p
 
 	mtdoob = xzalloc(sizeof(*mtdoob));
 	mtdoob->cdev.ops = &mtd_ops_oob;
-	mtdoob->cdev.size = mtd_div_by_wb(mtd->size, mtd) * mtd->oobsize;
+	mtdoob->cdev.size = mtd_div_by_wb(mtd->size, mtd) * (loff_t)mtd->oobsize;
 	mtdoob->cdev.name = basprintf("%s.oob", mtd->cdev.name);
 	mtdoob->cdev.priv = mtdoob;
 	mtdoob->cdev.dev = &mtd->dev;
diff --git a/drivers/mtd/peb.c b/drivers/mtd/peb.c
index f3c51a61b4eb..03d96c2a5a7e 100644
--- a/drivers/mtd/peb.c
+++ b/drivers/mtd/peb.c
@@ -695,7 +695,7 @@ int mtd_peb_create_bitflips(struct mtd_info *mtd, int pnum, int offset,
 	ops.ooblen = mtd->oobsize;
 
 	for (i = 0; i < pages_per_block; i++) {
-		loff_t offs = (loff_t)pnum * mtd->erasesize + i * mtd->writesize;
+		loff_t offs = (loff_t)pnum * mtd->erasesize + i * (loff_t)mtd->writesize;
 
 		ops.datbuf = buf + i * mtd->writesize;
 		ops.oobbuf = oobbuf + i * mtd->oobsize;
@@ -738,7 +738,7 @@ int mtd_peb_create_bitflips(struct mtd_info *mtd, int pnum, int offset,
 	}
 
 	for (i = 0; i < pages_per_block; i++) {
-		loff_t offs = (loff_t)pnum * mtd->erasesize + i * mtd->writesize;
+		loff_t offs = (loff_t)pnum * mtd->erasesize + i * (loff_t)mtd->writesize;
 
 		ops.datbuf = buf + i * mtd->writesize;
 		ops.oobbuf = oobbuf + i * mtd->oobsize;
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index bd748ff5b4b3..383916e3f4b0 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -1131,7 +1131,7 @@ static int spi_nor_init_params(struct spi_nor *nor,
 	memset(params, 0, sizeof(*params));
 
 	/* Set SPI NOR sizes. */
-	params->size = info->sector_size * info->n_sectors;
+	params->size = info->sector_size * (u64)info->n_sectors;
 	params->page_size = info->page_size;
 
 	/* (Fast) Read settings. */
-- 
2.29.2


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox


  parent reply	other threads:[~2021-03-24 12:26 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-24 12:22 [PATCH 1/4] net: phy: at803x: fix incorrect use of FIELD_PREP Ahmad Fatoum
2021-03-24 12:22 ` [PATCH 2/4] clk: imx: clk-pllv1: fix wrong PLL recalc on i.MX1/i.MX21 Ahmad Fatoum
2021-03-24 12:22 ` [PATCH 3/4] kbuild: add -Wtype-limits to compile flags Ahmad Fatoum
2021-03-24 12:22 ` Ahmad Fatoum [this message]
2021-03-25 12:46 ` [PATCH 1/4] net: phy: at803x: fix incorrect use of FIELD_PREP Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210324122247.10683-4-a.fatoum@pengutronix.de \
    --to=a.fatoum@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    --cc=bst@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox