Message ID | CAFbHwiTfaXOFX-WYWeyisK4WCiXBRv_LpEcoR=v8qvsLAO7FJQ@mail.gmail.com |
---|---|
State | New, archived |
Headers | show |
On Fri, 2012-03-30 at 11:51 +0100, Will Newton wrote: > Hi all, > > I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to > be happening is that otp_select_filemode calls mtd_read_fact_prot_reg > with -1 for offset and length and a NULL buffer to test if OTP > operations are supported. This finds its way down to otp_read in > mtd_dataflash.c and causes an oops when memcpying the returned data > into the NULL buf. Hi, good catch, thanks! I've added "Cc: stable@krnel.org [3.3+]" and pushed to l2-mtd.git, thanks you. But note, you should add your Signed-off-by when sending patches. Also this patch is line-wrapped so I had to do a small surgery to apply it. Try to save it from your mailbox and apply with 'git am'. Anyway, thanks for the catch.
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index 50c6a1e..853744d 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -369,7 +369,7 @@ static int otp_select_filemode(struct mtd_file_info *mfi, int mode) * Make a fake call to mtd_read_fact_prot_reg() to check if OTP * operations are supported. */ - if (mtd_read_fact_prot_reg(mtd, -1, -1, &retlen, NULL) == -EOPNOTSUPP) + if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == -EOPNOTSUPP) return -EOPNOTSUPP;