From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:40625 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751874AbbJQXxb (ORCPT ); Sat, 17 Oct 2015 19:53:31 -0400 Subject: Patch "UBI: Validate data_size" has been added to the 4.1-stable tree To: richard@nod.at, david@sigma-star.at, gregkh@linuxfoundation.org Cc: , From: Date: Sat, 17 Oct 2015 16:53:29 -0700 Message-ID: <144512600924493@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled UBI: Validate data_size to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ubi-validate-data_size.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 281fda27673f833a01d516658a64d22a32c8e072 Mon Sep 17 00:00:00 2001 From: Richard Weinberger Date: Tue, 22 Sep 2015 23:58:07 +0200 Subject: UBI: Validate data_size From: Richard Weinberger commit 281fda27673f833a01d516658a64d22a32c8e072 upstream. Make sure that data_size is less than LEB size. Otherwise a handcrafted UBI image is able to trigger an out of bounds memory access in ubi_compare_lebs(). Signed-off-by: Richard Weinberger Reviewed-by: David Gstir Signed-off-by: Greg Kroah-Hartman --- drivers/mtd/ubi/io.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/mtd/ubi/io.c +++ b/drivers/mtd/ubi/io.c @@ -926,6 +926,11 @@ static int validate_vid_hdr(const struct goto bad; } + if (data_size > ubi->leb_size) { + ubi_err(ubi, "bad data_size"); + goto bad; + } + if (vol_type == UBI_VID_STATIC) { /* * Although from high-level point of view static volumes may Patches currently in stable-queue which might be from richard@nod.at are queue-4.1/ubifs-kill-unneeded-locking-in-ubifs_init_security.patch queue-4.1/ubi-validate-data_size.patch queue-4.1/ubi-return-enospc-if-no-enough-space-available.patch