summaryrefslogtreecommitdiffstats
path: root/drivers/mtd
diff options
context:
space:
mode:
authorRobert Jarzmik <robert.jarzmik@free.fr>2012-03-22 21:00:50 +0100
committerDavid Woodhouse <David.Woodhouse@intel.com>2012-03-27 01:03:00 +0100
commita7baef1211b0ac218299965481e7cff9d68c1edd (patch)
treed9737628c725cb983dfebf9958c3093c4f66573d /drivers/mtd
parenta78da28776496d3a850ce741d3474b65057e156b (diff)
downloadop-kernel-dev-a7baef1211b0ac218299965481e7cff9d68c1edd.zip
op-kernel-dev-a7baef1211b0ac218299965481e7cff9d68c1edd.tar.gz
mtd: docg3 fix inbound calculations
The last erase block was not accessible, as the out of bound check was incorrectly rejecting the last block. The read/write/erase offset checks were forbidding the usage of the last block, because of the calculation which was considering the byte after the last instead of the last byte. Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/devices/docg3.c17
1 files changed, 5 insertions, 12 deletions
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index f5930ca..62e0111 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -872,11 +872,8 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t from,
if (ooblen % DOC_LAYOUT_OOB_SIZE)
return -EINVAL;
- ret = -EINVAL;
- calc_block_sector(from + len, &block0, &block1, &page, &ofs,
- docg3->reliable);
- if (block1 > docg3->max_block)
- goto err;
+ if (from + len > mtd->size)
+ return -EINVAL;
ops->oobretlen = 0;
ops->retlen = 0;
@@ -1207,7 +1204,7 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *info)
calc_block_sector(info->addr + info->len, &block0, &block1, &page,
&ofs, docg3->reliable);
ret = -EINVAL;
- if (block1 > docg3->max_block || page || ofs)
+ if (info->addr + info->len > mtd->size || page || ofs)
goto reset_err;
ret = 0;
@@ -1443,12 +1440,8 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
if (len && ooblen &&
(len / DOC_LAYOUT_PAGE_SIZE) != (ooblen / oobdelta))
return -EINVAL;
-
- ret = -EINVAL;
- calc_block_sector(ofs + len, &block0, &block1, &page, &pofs,
- docg3->reliable);
- if (block1 > docg3->max_block)
- goto err;
+ if (ofs + len > mtd->size)
+ return -EINVAL;
ops->oobretlen = 0;
ops->retlen = 0;
OpenPOWER on IntegriCloud