mtd: mtdram: check offs and len in mtdram->erase

We should prevent user to erasing mtd device with
an unaligned offset or length.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index 8e285089229c364ee29c6b4f7c90a872d6e7c693..627a9bc3767927a85d8a15a3eb1a74275673d251 100644 (file)
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -32,8 +32,29 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB");
 // We could store these in the mtd structure, but we only support 1 device..
 static struct mtd_info *mtd_info;
 
+static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+       int ret = 0;
+
+       /* Start address must align on block boundary */
+       if (mtd_mod_by_eb(ofs, mtd)) {
+               pr_debug("%s: unaligned address\n", __func__);
+               ret = -EINVAL;
+       }
+
+       /* Length must align on block boundary */
+       if (mtd_mod_by_eb(len, mtd)) {
+               pr_debug("%s: length not block aligned\n", __func__);
+               ret = -EINVAL;
+       }
+
+       return ret;
+}
+
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
+       if (check_offs_len(mtd, instr->addr, instr->len))
+               return -EINVAL;
        memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
        instr->state = MTD_ERASE_DONE;
        mtd_erase_callback(instr);