From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Boris Brezillon" <boris.brezillon@free-electrons.com>,
"Richard Weinberger" <richard@nod.at>
Subject: [PATCH 3.2 57/62] ubi: Fix out of bounds write in volume update code
Date: Tue, 29 Mar 2016 20:18:22 +0100 [thread overview]
Message-ID: <lsq.1459279102.243218743@decadent.org.uk> (raw)
In-Reply-To: <lsq.1459279101.951687763@decadent.org.uk>
3.2.79-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit e4f6daac20332448529b11f09388f1d55ef2084c upstream.
ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/mtd/ubi/upd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -197,7 +197,7 @@ int ubi_start_leb_change(struct ubi_devi
vol->ch_lnum = req->lnum;
vol->ch_dtype = req->dtype;
- vol->upd_buf = vmalloc(req->bytes);
+ vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size));
if (!vol->upd_buf)
return -ENOMEM;
next prev parent reply other threads:[~2016-03-29 19:18 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-29 19:18 [PATCH 3.2 00/62] 3.2.79-rc1 review Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 12/62] libata: fix HDIO_GET_32BIT ioctl Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 41/62] ipr: Fix out-of-bounds null overwrite Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 13/62] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 04/62] wext: fix message delay/ordering Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 53/62] PM / sleep / x86: Fix crash on graph trace through x86 suspend Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 23/62] x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 46/62] ALSA: hdspm: Fix wrong boolean ctl value accesses Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 28/62] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 05/62] cfg80211/wext: fix message ordering Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 21/62] af_unix: Guard against other == sk in unix_dgram_sendmsg Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 11/62] s390/dasd: fix refcount for PAV reassignment Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 59/62] s390/mm: four page table levels vs. fork Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 45/62] ALSA: timer: Fix broken compat timer user status ioctl Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 34/62] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 16/62] ALSA: seq: Fix leak of pool buffer at concurrent writes Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 40/62] libata: Align ata_device's id on a cacheline Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 48/62] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 20/62] af_unix: Don't set err in unix_stream_read_generic unless there was an error Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 42/62] ipr: Fix regression when loading firmware Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 37/62] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 03/62] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 49/62] ASoC: wm8958: Fix enum ctl accesses in a wrong type Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 09/62] cifs: fix erroneous return value Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 32/62] kernel/resource.c: fix muxed resource handling in __request_region() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 38/62] jffs2: Fix page lock / f->sem deadlock Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 60/62] Input: aiptek - fix crash on detecting device without endpoints Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 50/62] ASoC: wm8994: Fix enum ctl accesses in a wrong type Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 51/62] USB: serial: option: add support for Quectel UC20 Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 62/62] HID: usbhid: fix recursive deadlock Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 58/62] Revert "drm/radeon: call hpd_irq_event on resume" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 52/62] ALSA: seq: oss: Don't drain at closing a client Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 31/62] ext4: fix bh->b_state corruption Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 25/62] usb: dwc3: Fix assignment of EP transfer resources Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 24/62] x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 17/62] tracepoints: Do not trace when cpu is offline Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 30/62] Adding Intel Lewisburg device IDs for SATA Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 56/62] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 39/62] Fix directory hardlinks from deleted directories Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 47/62] ALSA: hdsp: Fix wrong boolean ctl value accesses Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 01/62] Revert "crypto: algif_skcipher - Do not dereference ctx without socket lock" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 44/62] hpfs: don't truncate the file when delete fails Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 10/62] s390/dasd: prevent incorrect length error under z/VM after PAV changes Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 07/62] nfs: fix nfs_size_to_loff_t Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 15/62] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 54/62] IB/core: Use GRH when the path hop-limit > 0 Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 08/62] drm/i915: fix error path in intel_setup_gmbus() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 27/62] USB: option: add support for SIM7100E Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 18/62] tracing: Fix freak link error caused by branch tracer Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 22/62] x86, extable: Remove open-coded exception table entries in arch/x86/lib/copy_user_nocache_64.S Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 14/62] xen/pciback: Save the number of MSI-X entries to be copied later Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 26/62] net/mlx4_en: Count HW buffer overrun only once Ben Hutchings
2016-03-29 19:18 ` Ben Hutchings [this message]
2016-03-29 19:18 ` [PATCH 3.2 02/62] crypto: {blk,giv}cipher: Set has_setkey Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 43/62] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 29/62] USB: option: add "4G LTE usb-modem U901" Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 33/62] can: ems_usb: Fix possible tx overflow Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 06/62] mac80211: fix use of uninitialised values in RX aggregation Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 35/62] sunrpc/cache: fix off-by-one in qword_get() Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 19/62] ALSA: seq: Fix double port list deletion Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 36/62] KVM: async_pf: do not warn on page allocation failures Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 61/62] include/linux/poison.h: fix LIST_POISON{1,2} offset Ben Hutchings
2016-03-29 19:18 ` [PATCH 3.2 55/62] mld, igmp: Fix reserved tailroom calculation Ben Hutchings
2016-03-29 20:19 ` [PATCH 3.2 00/62] 3.2.79-rc1 review Ben Hutchings
2016-03-29 20:26 ` Guenter Roeck
2016-03-29 21:03 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1459279102.243218743@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=boris.brezillon@free-electrons.com \
--cc=linux-kernel@vger.kernel.org \
--cc=richard@nod.at \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox