diff options
| author | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2011-01-16 16:50:54 +0100 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2011-01-17 16:25:48 +0100 |
| commit | 154bf89f5e3e3dc59666926f27ca4a0866f39157 (patch) | |
| tree | a32ef2abaa71157b2df3699b62eea774b593acb1 /drivers | |
| parent | mtd: pxa3xx_nand: NULL dereference in pxa3xx_nand_probe (diff) | |
| download | linux-154bf89f5e3e3dc59666926f27ca4a0866f39157.tar.xz linux-154bf89f5e3e3dc59666926f27ca4a0866f39157.zip | |
mtd: mtdpart: disallow reading OOB past the end of the partition
This patch fixes the mtdpart bug which allows users reading OOB past the
end of the partition. This happens because 'part_read_oob()' allows reading
multiple OOB areas in one go, and mtdparts does not validate the OOB
length in the request.
Although there is such check in 'nand_do_read_oob()' in nand_base.c, but
it checks that we do not read past the flash chip, not the partition,
because in nand_base.c we work with the whole chip (e.g., mtd->size
in nand_base.c is the size of the whole chip). So this check cannot
be done correctly in nand_base.c and should be instead done in mtdparts.c.
This problem was reported by Jason Liu <r64343@freescale.com> and reproduced
with nandsim:
$ modprobe nandsim first_id_byte=0x20 second_id_byte=0xaa third_id_byte=0x00 \
fourth_id_byte=0x15 parts=0x400,0x400
$ modprobe nandsim mtd_oobtest.ko dev=0
$ dmesg
= snip =
mtd_oobtest: attempting to read past end of device
mtd_oobtest: an error is expected...
mtd_oobtest: error: read past end of device
= snip =
mtd_oobtest: finished with 2 errors
Reported-by: Jason Liu <liu.h.jason@gmail.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mtd/mtdpart.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index b910a37baed8..0a4760174782 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -120,8 +120,25 @@ static int part_read_oob(struct mtd_info *mtd, loff_t from, return -EINVAL; if (ops->datbuf && from + ops->len > mtd->size) return -EINVAL; - res = part->master->read_oob(part->master, from + part->offset, ops); + /* + * If OOB is also requested, make sure that we do not read past the end + * of this partition. + */ + if (ops->oobbuf) { + size_t len, pages; + + if (ops->mode == MTD_OOB_AUTO) + len = mtd->oobavail; + else + len = mtd->oobsize; + pages = mtd_div_by_ws(mtd->size, mtd); + pages -= mtd_div_by_ws(from, mtd); + if (ops->ooboffs + ops->ooblen > pages * len) + return -EINVAL; + } + + res = part->master->read_oob(part->master, from + part->offset, ops); if (unlikely(res)) { if (res == -EUCLEAN) mtd->ecc_stats.corrected++; |