From: Ahmad Fatoum <[email protected]>
Probe subtracts the size of the CRC and flag header from the size of
each copy unchecked. For a partition smaller than that, the size wraps
around and the CRC is computed over most of the address space.
Let's fail probe with -EINVAL for such a copy instead.
Fixes: 9fdbd39f320a ("misc: Add a driver to expose U-Boot environment variable
data")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <[email protected]>
---
drivers/misc/ubootvar.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/misc/ubootvar.c b/drivers/misc/ubootvar.c
index 8c387843bab1..9e2600b5c527 100644
--- a/drivers/misc/ubootvar.c
+++ b/drivers/misc/ubootvar.c
@@ -232,6 +232,13 @@ static int ubootenv_probe(struct device *dev)
goto out;
}
+ if (size[i] < sizeof(uint32_t) + (count > 1)) {
+ dev_err(dev, "U-Boot environment %s is too small\n",
+ ubdata->path[i]);
+ ret = -EINVAL;
+ goto out;
+ }
+
crc[i] = *(uint32_t *)data[i];
size[i] -= sizeof(uint32_t);
--
2.47.3
