[PATCH v4 1/5] nvmem: check invalid number of bytes in nvmem_device_{read,write}

[Biju Das]

Add check in nvmem_device_{read,write}()to ensure that nvmem core never
passes an invalid number of bytes.

Signed-off-by: Biju Das <biju....@bp.renesas.com>
---
V3-->V4
        * New patch.
---
 drivers/nvmem/core.c | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index d9fd110..db7de33 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1433,10 +1433,21 @@ int nvmem_device_read(struct nvmem_device *nvmem,
                      size_t bytes, void *buf)
 {
        int rc;
+       size_t new_bytes;
 
        if (!nvmem)
                return -EINVAL;
 
+       /* Stop the user from reading */
+       if ((offset >= nvmem->size) || (bytes == 0))
+               return 0;
+
+       if (unlikely(check_add_overflow(bytes, offset, &new_bytes)))
+               return -EOVERFLOW;
+
+       if (new_bytes > nvmem->size)
+               bytes = nvmem->size - offset;
+
        rc = nvmem_reg_read(nvmem, offset, buf, bytes);
 
        if (rc)
@@ -1461,16 +1472,29 @@ int nvmem_device_write(struct nvmem_device *nvmem,
                       size_t bytes, void *buf)
 {
        int rc;
+       size_t new_bytes;
 
        if (!nvmem)
                return -EINVAL;
 
+       /* Stop the user from writing */
+       if (offset >= nvmem->size)
+               return -ENOSPC;
+
+       if (bytes == 0)
+               return 0;
+
+       if (unlikely(check_add_overflow(bytes, offset, &new_bytes)))
+               return -EOVERFLOW;
+
+       if (new_bytes > nvmem->size)
+               bytes = nvmem->size - offset;
+
        rc = nvmem_reg_write(nvmem, offset, buf, bytes);
 
        if (rc)
                return rc;
 
-
        return bytes;
 }
 EXPORT_SYMBOL_GPL(nvmem_device_write);
-- 
2.7.4