mtd: docg3 fix inbound calculations

The last erase block was not accessible, as the out of bound
check was incorrectly rejecting the last block.
The read/write/erase offset checks were forbidding the usage of the
last block, because of the calculation which was considering the
byte after the last instead of the last byte.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

1 files changed, 5 insertions, 12 deletions

diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index f5930caa38e7..62e01113c317 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -872,11 +872,8 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t from,
         if (ooblen % DOC_LAYOUT_OOB_SIZE)
                 return -EINVAL;
 
-        ret = -EINVAL;
-        calc_block_sector(from + len, &block0, &block1, &page, &ofs,
-                          docg3->reliable);
-        if (block1 > docg3->max_block)
-                goto err;
+        if (from + len > mtd->size)
+                return -EINVAL;
 
         ops->oobretlen = 0;
         ops->retlen = 0;
@@ -1207,7 +1204,7 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *info)
         calc_block_sector(info->addr + info->len, &block0, &block1, &page,
                           &ofs, docg3->reliable);
         ret = -EINVAL;
-        if (block1 > docg3->max_block || page || ofs)
+        if (info->addr + info->len > mtd->size || page || ofs)
                 goto reset_err;
 
         ret = 0;
@@ -1443,12 +1440,8 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
         if (len && ooblen &&
             (len / DOC_LAYOUT_PAGE_SIZE) != (ooblen / oobdelta))
                 return -EINVAL;
-
-        ret = -EINVAL;
-        calc_block_sector(ofs + len, &block0, &block1, &page, &pofs,
-                          docg3->reliable);
-        if (block1 > docg3->max_block)
-                goto err;
+        if (ofs + len > mtd->size)
+                return -EINVAL;
 
         ops->oobretlen = 0;
         ops->retlen = 0;