This is a note to let you know that I've just added the patch titled
mtd: nandsim: bugfix: fail if overridesize is too big
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 Mon Sep 17 00:00:00 2001
From: Richard Genoud <[email protected]>
Date: Wed, 12 Sep 2012 14:26:26 +0200
Subject: mtd: nandsim: bugfix: fail if overridesize is too big
From: Richard Genoud <[email protected]>
commit bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 upstream.
If override size is too big, the module was actually loaded instead of
failing, because retval was not set.
This lead to memory corruption with the use of the freed structs nandsim
and nand_chip.
Signed-off-by: Richard Genoud <[email protected]>
Signed-off-by: Artem Bityutskiy <[email protected]>
Signed-off-by: David Woodhouse <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/mtd/nand/nandsim.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2355,6 +2355,7 @@ static int __init ns_init_module(void)
uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
if (new_size >> overridesize != nsmtd->erasesize) {
NS_ERR("overridesize is too big\n");
+ retval = -EINVAL;
goto err_exit;
}
/* N.B. This relies on nand_scan not doing anything with the
size before we change it */
Patches currently in stable-queue which might be from [email protected]
are
queue-3.4/mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
