From patchwork Sat Aug 8 15:29:27 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: roel kluin X-Patchwork-Id: 30999 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by bilbo.ozlabs.org (Postfix) with ESMTPS id A8B4DB7B6C for ; Sun, 9 Aug 2009 01:29:20 +1000 (EST) Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1MZnnw-0006Lb-1L; Sat, 08 Aug 2009 15:25:56 +0000 Received: from ey-out-1920.google.com ([74.125.78.145]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1MZnno-0006L0-PB for linux-mtd@lists.infradead.org; Sat, 08 Aug 2009 15:25:54 +0000 Received: by ey-out-1920.google.com with SMTP id 5so730383eyb.24 for ; Sat, 08 Aug 2009 08:25:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=bnGfzUIsRs7WS5hE4y5RB3Lw+FUuME/a2sl45d8Pq7M=; b=AtTRZKcNIfl+kaXEJ7mgGkURCKIHw24U0cwRueEQs+qJ4fGP4usL0hgSkOeTpDLTwd xjKgCASMJskT5mqe8Z4WA1fobYXhObGIkcVOcYMZtJDJJqH5Pmkd4Zh81U1Me3GQjyBK cCz6vmyAKnmBFU4TC4g5euJ+b4REvfybO4vx0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=ZoiruQDp/lgD1rmIqikWzbCVKGZffYdmZdkDMDuPNgxKgAY0UuyqsyOVrquQ+dvwl1 +qFFwT6k2YfjpTMX06obSMeo1uEK6TtDXLDgt7H+tLnQBtzidLCkhiyJQHbxz8QXRKgW WIY9nuSN/PkESCmrahj57T9Ux+PTrDnqwgxYw= Received: by 10.210.102.9 with SMTP id z9mr2889396ebb.16.1249745146977; Sat, 08 Aug 2009 08:25:46 -0700 (PDT) Received: from zoinx.mars (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 10sm5936707eyd.57.2009.08.08.08.25.46 (version=SSLv3 cipher=RC4-MD5); Sat, 08 Aug 2009 08:25:46 -0700 (PDT) Message-ID: <4A7D99D7.5050101@gmail.com> Date: Sat, 08 Aug 2009 17:29:27 +0200 From: Roel Kluin User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2 MIME-Version: 1.0 To: David Woodhouse , linux-mtd@lists.infradead.org, Andrew Morton Subject: [PATCH] MTD/JFFS2: Read buffer overflow X-Spam-Score: 0.0 (/) X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Prevent a read from mtd->eraseregions[-1] Signed-off-by: Roel Kluin diff --git a/drivers/mtd/devices/lart.c b/drivers/mtd/devices/lart.c index 578de1c..f4359fe 100644 --- a/drivers/mtd/devices/lart.c +++ b/drivers/mtd/devices/lart.c @@ -393,7 +393,8 @@ static int flash_erase (struct mtd_info *mtd,struct erase_info *instr) * erase range is aligned with the erase size which is in * effect here. */ - if (instr->addr & (mtd->eraseregions[i].erasesize - 1)) return (-EINVAL); + if (i < 0 || (instr->addr & (mtd->eraseregions[i].erasesize - 1))) + return -EINVAL; /* Remember the erase region we start on */ first = i; @@ -409,7 +410,8 @@ static int flash_erase (struct mtd_info *mtd,struct erase_info *instr) i--; /* is the end aligned on a block boundary? */ - if ((instr->addr + instr->len) & (mtd->eraseregions[i].erasesize - 1)) return (-EINVAL); + if (i < 0 || ((instr->addr + instr->len) & (mtd->eraseregions[i].erasesize - 1))) + return -EINVAL; addr = instr->addr; len = instr->len;