diff options
| author | Andrew Goodbody <[email protected]> | 2025-07-03 11:00:33 +0100 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2025-07-14 15:16:30 -0600 |
| commit | bae3a34cb9e6b3ce6d01f68cdd34cdd45419f22f (patch) | |
| tree | 82b2d28681b772356d38012afdfefefe60c25e24 /drivers | |
| parent | ebfbc77109a1fee5db71f767dd1f58d7c68bb442 (diff) | |
cros_ec: sandbox: Use correct value for number of slots
In the definition of struct ec_state the number of slots that are
created is VSTORE_SLOT_COUNT (==4) but the value of req->slot is
checked against EC_VSTORE_SLOT_MAX (==32) so this can lead to memory
access beyond that allocated.
Instead change the size check to use VSTORE_SLOT_COUNT to ensure it
matches what has actually been allocated.
This issue found by Smatch.
Signed-off-by: Andrew Goodbody <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/misc/cros_ec_sandbox.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/misc/cros_ec_sandbox.c b/drivers/misc/cros_ec_sandbox.c index 3ac690a3733..432b1fbb0c4 100644 --- a/drivers/misc/cros_ec_sandbox.c +++ b/drivers/misc/cros_ec_sandbox.c @@ -540,7 +540,7 @@ static int process_cmd(struct ec_state *ec, const struct ec_params_vstore_write *req = req_data; struct vstore_slot *slot; - if (req->slot >= EC_VSTORE_SLOT_MAX) + if (req->slot >= VSTORE_SLOT_COUNT) return -EINVAL; slot = &ec->slot[req->slot]; slot->locked = true; @@ -553,7 +553,7 @@ static int process_cmd(struct ec_state *ec, struct ec_response_vstore_read *resp = resp_data; struct vstore_slot *slot; - if (req->slot >= EC_VSTORE_SLOT_MAX) + if (req->slot >= VSTORE_SLOT_COUNT) return -EINVAL; slot = &ec->slot[req->slot]; memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE); |