Skip to content

Commit 74edd08

Browse files
MrVanbroonie
authored andcommitted
regmap: debugfs: check count when read regmap file
When executing the following command, we met kernel dump. dmesg -c > /dev/null; cd /sys; for i in `ls /sys/kernel/debug/regmap/* -d`; do echo "Checking regmap in $i"; cat $i/registers; done && grep -ri "0x02d0" *; It is because the count value is too big, and kmalloc fails. So add an upper bound check to allow max size `PAGE_SIZE << (MAX_ORDER - 1)`. Signed-off-by: Peng Fan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Mark Brown <[email protected]>
1 parent bb6d3fb commit 74edd08

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

drivers/base/regmap/regmap-debugfs.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
227227
if (*ppos < 0 || !count)
228228
return -EINVAL;
229229

230+
if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
231+
count = PAGE_SIZE << (MAX_ORDER - 1);
232+
230233
buf = kmalloc(count, GFP_KERNEL);
231234
if (!buf)
232235
return -ENOMEM;
@@ -371,6 +374,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
371374
if (*ppos < 0 || !count)
372375
return -EINVAL;
373376

377+
if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
378+
count = PAGE_SIZE << (MAX_ORDER - 1);
379+
374380
buf = kmalloc(count, GFP_KERNEL);
375381
if (!buf)
376382
return -ENOMEM;

0 commit comments

Comments
 (0)