Re: [U-Boot] [PATCH v2] cros_ec: Fix issue with cros_ec_flash_write command

[Simon Glass]

On 22 September 2016 at 22:15, Simon Glass  wrote:
> On 12 September 2016 at 13:57, Moritz Fischer  
> wrote:
>> This commit fixes an issue where data is written to an
>> invalid memory location.
>> The issue has been introduced in commit
>> (88364387 cros: add cros_ec_driver)
>>
>> Cc: Simon Glass 
>> Cc: u-boot@lists.denx.de
>> Signed-off-by: Moritz Fischer 
>> ---
>> Changes from v1:
>>  - Fixed accidential change of command version
>>  - Removed added whitespace
>> ---
>>  drivers/misc/cros_ec.c | 23 ---
>>  1 file changed, 16 insertions(+), 7 deletions(-)
>
> Reviewed-by: Simon Glass 

Applied to u-boot-dm, thanks!
___
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot

Re: [U-Boot] [PATCH v2] cros_ec: Fix issue with cros_ec_flash_write command

[Simon Glass]

On 12 September 2016 at 13:57, Moritz Fischer  wrote:
> This commit fixes an issue where data is written to an
> invalid memory location.
> The issue has been introduced in commit
> (88364387 cros: add cros_ec_driver)
>
> Cc: Simon Glass 
> Cc: u-boot@lists.denx.de
> Signed-off-by: Moritz Fischer 
> ---
> Changes from v1:
>  - Fixed accidential change of command version
>  - Removed added whitespace
> ---
>  drivers/misc/cros_ec.c | 23 ---
>  1 file changed, 16 insertions(+), 7 deletions(-)

Reviewed-by: Simon Glass 
___
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot

[U-Boot] [PATCH v2] cros_ec: Fix issue with cros_ec_flash_write command

[Moritz Fischer]

This commit fixes an issue where data is written to an
invalid memory location.
The issue has been introduced in commit
(88364387 cros: add cros_ec_driver)

Cc: Simon Glass 
Cc: u-boot@lists.denx.de
Signed-off-by: Moritz Fischer 
---
Changes from v1:
 - Fixed accidential change of command version
 - Removed added whitespace
---
 drivers/misc/cros_ec.c | 23 ---
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/cros_ec.c b/drivers/misc/cros_ec.c
index 44b4f59..06a7dcc 100644
--- a/drivers/misc/cros_ec.c
+++ b/drivers/misc/cros_ec.c
@@ -760,15 +760,24 @@ int cros_ec_flash_erase(struct cros_ec_dev *dev, uint32_t 
offset, uint32_t size)
 static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
const uint8_t *data, uint32_t offset, uint32_t size)
 {
-   struct ec_params_flash_write p;
+   struct ec_params_flash_write *p;
+   int ret;
 
-   p.offset = offset;
-   p.size = size;
-   assert(data && p.size <= EC_FLASH_WRITE_VER0_SIZE);
-   memcpy( + 1, data, p.size);
+   p = malloc(sizeof(*p) + size);
+   if (!p)
+   return -ENOMEM;
+
+   p->offset = offset;
+   p->size = size;
+   assert(data && p->size <= EC_FLASH_WRITE_VER0_SIZE);
+   memcpy(p + 1, data, p->size);
 
-   return ec_command_inptr(dev, EC_CMD_FLASH_WRITE, 0,
- , sizeof(p), NULL, 0) >= 0 ? 0 : -1;
+   ret = ec_command_inptr(dev, EC_CMD_FLASH_WRITE, 0,
+ p, sizeof(*p) + size, NULL, 0) >= 0 ? 0 : -1;
+
+   free(p);
+
+   return ret;
 }
 
 /**
-- 
2.7.4

___
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot