Message ID | 1572874189-32264-2-git-send-email-debmc@linux.ibm.com |
---|---|
State | Superseded |
Headers | show |
Series | ipmi-hiomap: Enablement for Async opal_flash_op's | expand |
Context | Check | Description |
---|---|---|
snowpatch_ozlabs/apply_patch | success | Successfully applied on branch master (d75e82dbfbb9443efeb3f9a5921ac23605aab469) |
snowpatch_ozlabs/snowpatch_job_snowpatch-skiboot | success | Test snowpatch/job/snowpatch-skiboot on branch master |
snowpatch_ozlabs/snowpatch_job_snowpatch-skiboot-dco | success | Signed-off-by present |
On 11/4/19 6:59 PM, Deb McLemore wrote: > From: Cyril Bur <cyril.bur@au1.ibm.com> > > A bounds checking mistake prevents opal_flash_{read,write,erase} calls > from having a length equal to the size of the flash. This bug has been > present since the beginning (e7d1f60e core/flash: Add flash API) of > these calls. > > Until before d6a5b53f libflash/blocklevel: Add blocklevel_smart_erase() > 6/4/2017 none of our tools would have performed a single command for the > full size of the flash. It would still have been possible to persuade > `dd` to do this by using a block size equal to the size of the flash > or other mtd related tools. > > Any pflash built with blocklevel_smart_erase() will perform one call to > Linux and then Skiboot for the size of flash. > > Signed-off-by: Cyril Bur <cyril.bur@au1.ibm.com> > Acked-by: Samuel Mendoza-Jonas <sam@mendozajonas.com> > Reviewed-By: Alistair Popple <alistair@popple.id.au> > Signed-off-by: Stewart Smith <stewart@linux.ibm.com> This is real fix. IMO it should go as independent patch without waiting for entire series to ready. -Vasant
diff --git a/core/flash.c b/core/flash.c index 7fbfca2..2f041db 100644 --- a/core/flash.c +++ b/core/flash.c @@ -10,6 +10,7 @@ #include <skiboot.h> #include <cpu.h> +#include <inttypes.h> #include <lock.h> #include <opal.h> #include <opal-msg.h> @@ -436,8 +437,10 @@ static int64_t opal_flash_op(enum flash_op op, uint64_t id, uint64_t offset, goto err; } - if (size >= flash->size || offset >= flash->size + if (size > flash->size || offset >= flash->size || offset + size > flash->size) { + prlog(PR_DEBUG, "Requested flash op %d beyond flash size %" PRIu64 "\n", + op, flash->size); rc = OPAL_PARAMETER; goto err; }