* [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big
@ 2012-09-12 12:26 Richard Genoud
2012-09-18 8:27 ` Richard Genoud
2012-09-25 14:05 ` Artem Bityutskiy
0 siblings, 2 replies; 4+ messages in thread
From: Richard Genoud @ 2012-09-12 12:26 UTC (permalink / raw)
To: David Woodhouse, Artem Bityutskiy
Cc: Richard Genoud, linux-mtd, Adrian Hunter
If override size is too big, the module was actually loaded instead of
failing, because retval was not set.
This lead to memory corruption with the use of the freed structs nandsim
and nand_chip.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
---
drivers/mtd/nand/nandsim.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index cf0cd31..5d881180 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2333,6 +2333,7 @@ static int __init ns_init_module(void)
uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
if (new_size >> overridesize != nsmtd->erasesize) {
NS_ERR("overridesize is too big\n");
+ retval = -EINVAL;
goto err_exit;
}
/* N.B. This relies on nand_scan not doing anything with the size before we change it */
--
1.7.2.5
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big
2012-09-12 12:26 [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big Richard Genoud
@ 2012-09-18 8:27 ` Richard Genoud
2012-09-26 9:52 ` Artem Bityutskiy
2012-09-25 14:05 ` Artem Bityutskiy
1 sibling, 1 reply; 4+ messages in thread
From: Richard Genoud @ 2012-09-18 8:27 UTC (permalink / raw)
To: David Woodhouse, Artem Bityutskiy; +Cc: linux-mtd, Adrian Hunter
2012/9/12 Richard Genoud <richard.genoud@gmail.com>:
> If override size is too big, the module was actually loaded instead of
> failing, because retval was not set.
>
> This lead to memory corruption with the use of the freed structs nandsim
> and nand_chip.
>
> Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
> ---
> drivers/mtd/nand/nandsim.c | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
> index cf0cd31..5d881180 100644
> --- a/drivers/mtd/nand/nandsim.c
> +++ b/drivers/mtd/nand/nandsim.c
> @@ -2333,6 +2333,7 @@ static int __init ns_init_module(void)
> uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
> if (new_size >> overridesize != nsmtd->erasesize) {
> NS_ERR("overridesize is too big\n");
> + retval = -EINVAL;
> goto err_exit;
> }
> /* N.B. This relies on nand_scan not doing anything with the size before we change it */
> --
> 1.7.2.5
>
Hi Artem, David.
As this is a bug fix, it should be pushed to 3.6-rc7, shouldn't it ?
Regards,
Richard.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big
2012-09-18 8:27 ` Richard Genoud
@ 2012-09-26 9:52 ` Artem Bityutskiy
0 siblings, 0 replies; 4+ messages in thread
From: Artem Bityutskiy @ 2012-09-26 9:52 UTC (permalink / raw)
To: Richard Genoud; +Cc: linux-mtd, David Woodhouse, Adrian Hunter
[-- Attachment #1: Type: text/plain, Size: 290 bytes --]
On Tue, 2012-09-18 at 10:27 +0200, Richard Genoud wrote:
> As this is a bug fix, it should be pushed to 3.6-rc7, shouldn't it ?
Well, it is a fix for an ancient bug, so it is enough to CC the stable
tree and merge this patch normally, I think.
--
Best Regards,
Artem Bityutskiy
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big
2012-09-12 12:26 [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big Richard Genoud
2012-09-18 8:27 ` Richard Genoud
@ 2012-09-25 14:05 ` Artem Bityutskiy
1 sibling, 0 replies; 4+ messages in thread
From: Artem Bityutskiy @ 2012-09-25 14:05 UTC (permalink / raw)
To: Richard Genoud; +Cc: linux-mtd, David Woodhouse, Adrian Hunter
[-- Attachment #1: Type: text/plain, Size: 413 bytes --]
On Wed, 2012-09-12 at 14:26 +0200, Richard Genoud wrote:
> If override size is too big, the module was actually loaded instead of
> failing, because retval was not set.
>
> This lead to memory corruption with the use of the freed structs nandsim
> and nand_chip.
>
> Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Pushed to l2-mtd.git, CCed -stable.
--
Best Regards,
Artem Bityutskiy
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-09-26 9:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-12 12:26 [PATCH] MTD: nandsim: BUG: Fail if overridesize is too big Richard Genoud
2012-09-18 8:27 ` Richard Genoud
2012-09-26 9:52 ` Artem Bityutskiy
2012-09-25 14:05 ` Artem Bityutskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox