Laxman Dewangan 6560ffd1cc regmap: fix possible memory corruption in regmap_bulk_read() ... The function regmap_bulk_read() calls the regmap_read() for each register if set of register has volatile and cache is enabled. In this case, last few register read makes the memory corruption if the register size is not the size of unsigned int. The regam_read() takes argument as unsigned int for returning value and it update the value as *val = map->format.parse_val(map->work_buf); This causes complete 4 bytes (size of unsigned int) to get written. Now if client pass the memory pointer for value which is equal to the required size of register count in regmap_bulk_read() then last few register read actually update the memory beyond passed pointer size. Avoid this by using local variable for read and then do memcpy() for actual byte copy to passed pointer based on register size. I allocated one pointer ptr and take first 16 bytes dump of that pointer then call regmap_bulk_read() with pointer which is just on top of this allocated pointer and register count of 128. Here register size is 1 byte. The memory trace of last 5 register read are as follows: [ 5.438589] regmap_bulk_read after regamp_read() for register 122 [ 5.447421] 0xef993c20 0xef993c00 0x00000000 0x00000001 [ 5.467535] regmap_bulk_read after regamp_read() for register 123 [ 5.476374] 0xef993c20 0xef993c00 0x00000000 0x00000001 [ 5.496425] regmap_bulk_read after regamp_read() for register 124 [ 5.505260] 0xef993c20 0xef993c00 0x00000000 0x00000001 [ 5.525372] regmap_bulk_read after regamp_read() for register 125 [ 5.534205] 0xef993c00 0xef993c00 0x00000000 0x00000001 [ 5.554258] regmap_bulk_read after regamp_read() for register 126 [ 5.563100] 0xef990000 0xef993c00 0x00000000 0x00000001 [ 5.554258] regmap_bulk_read after regamp_read() for register 127 [ 5.587108] 0xef000000 0xef993c00 0x00000000 0x00000001 Here it is observed that the memory content at first word started changing on last 3 regmap_read() and so corruption happened. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>		2012-05-09 15:44:11 +01:00
..
power	PM / Runtime: don't forget to wake up waitqueue on failure	2012-03-26 22:46:52 +02:00
regmap	regmap: fix possible memory corruption in regmap_bulk_read()	2012-05-09 15:44:11 +01:00
attribute_container.c
base.h	driver core: move the deferred probe pointer into the private area	2012-03-08 12:17:22 -08:00
bus.c	Merge 3.3-rc2 into the driver-core-next branch.	2012-02-02 11:24:44 -08:00
class.c
core.c	Core device tree changes for Linux v3.4	2012-03-21 10:30:03 -07:00
cpu.c	Merge 3.3-rc6 into driver-core-next	2012-03-09 12:35:53 -08:00
dd.c	driver core: minor comment formatting cleanups	2012-03-08 12:20:37 -08:00
devres.c
devtmpfs.c
dma-buf.c	dma-buf: add support for kernel cpu access	2012-03-26 11:33:02 +05:30
dma-coherent.c
dma-mapping.c
driver.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc	2012-03-21 18:55:10 -07:00
firmware_class.c	firmware_class: Move request_firmware_nowait() to workqueues	2012-03-28 23:31:00 +02:00
firmware.c
hypervisor.c
init.c
isa.c
Kconfig	drivers/base: add bus for System-on-Chip devices	2012-02-10 11:42:25 -08:00
Makefile	drivers/base: add bus for System-on-Chip devices	2012-02-10 11:42:25 -08:00
map.c
memory.c	Linux 3.3-rc7	2012-03-14 07:44:11 +01:00
module.c
node.c	drivers/base/memory.c: fix memory_dev_init() long delay	2012-02-02 15:50:05 -08:00
platform.c	drivercore: Output common devicetree information in uevent	2012-02-01 14:26:30 -07:00
soc.c	drivers/base: fix compiler warning in SoC export driver - idr should be ida	2012-04-09 14:54:22 -07:00
syscore.c
topology.c
transport_class.c