From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:42777 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751573AbbEBQ5r (ORCPT ); Sat, 2 May 2015 12:57:47 -0400 Subject: Patch "UBI: fix check for "too many bytes"" has been added to the 3.19-stable tree To: computersforpeace@gmail.com, gregkh@linuxfoundation.org, richard@nod.at Cc: , From: Date: Sat, 02 May 2015 18:56:05 +0200 Message-ID: <143058576586183@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled UBI: fix check for "too many bytes" to the 3.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ubi-fix-check-for-too-many-bytes.patch and it can be found in the queue-3.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 299d0c5b27346a77a0777c993372bf8777d4f2e5 Mon Sep 17 00:00:00 2001 From: Brian Norris Date: Sat, 28 Feb 2015 02:23:28 -0800 Subject: UBI: fix check for "too many bytes" From: Brian Norris commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream. The comparison from the previous line seems to have been erroneously (partially) copied-and-pasted onto the next. The second line should be checking req.bytes, not req.lnum. Coverity CID #139400 Signed-off-by: Brian Norris [rw: Fixed comparison] Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- drivers/mtd/ubi/cdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/mtd/ubi/cdev.c +++ b/drivers/mtd/ubi/cdev.c @@ -454,7 +454,7 @@ static long vol_cdev_ioctl(struct file * /* Validate the request */ err = -EINVAL; if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || - req.bytes < 0 || req.lnum >= vol->usable_leb_size) + req.bytes < 0 || req.bytes > vol->usable_leb_size) break; err = get_exclusive(ubi, desc); Patches currently in stable-queue which might be from computersforpeace@gmail.com are queue-3.19/ubi-initialize-leb-number-variable.patch queue-3.19/ubi-fix-out-of-bounds-write.patch queue-3.19/ubi-account-for-bitflips-in-both-the-vid-header-and-data.patch queue-3.19/ubi-fix-check-for-too-many-bytes.patch