nvmem: mxs-ocotp: fix buffer overflow in read

This patch fixes the issue where the mxs_ocotp_read is reading the ocotp in reg_size steps but decrements the remaining size by 1. The number of iterations is thus four times higher, overwriting the area behind the output buffer. Fixes: c01e9a1 ("nvmem: add driver for ocotp in i.MX23 and i.MX28") Tested-by: Stefan Wahren <[email protected]> Signed-off-by: Stanislav Meduna <[email protected]> Signed-off-by: Srinivas Kandagatla <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
ambv · May 2, 2016 · d1306eb · d1306eb
1 parent 1db488d
commit d1306eb
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/drivers/nvmem/mxs-ocotp.c b/drivers/nvmem/mxs-ocotp.c
@@ -94,7 +94,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size,
 	if (ret)
 		goto close_banks;
 
-	while (val_size) {
+	while (val_size >= reg_size) {
 		if ((offset < OCOTP_DATA_OFFSET) || (offset % 16)) {
 			/* fill up non-data register */
 			*buf = 0;
@@ -103,7 +103,7 @@ static int mxs_ocotp_read(void *context, const void *reg, size_t reg_size,
 		}
 
 		buf++;
-		val_size--;
+		val_size -= reg_size;
 		offset += reg_size;
 	}