Patchwork MTD: nandsim: BUG: Fail if overridesize is too big

login
register
mail settings
Submitter Richard Genoud
Date Sept. 12, 2012, 12:26 p.m.
Message ID <1347452786-10208-1-git-send-email-richard.genoud@gmail.com>
Download mbox | patch
Permalink /patch/183353/
State Accepted
Commit bb0a13a13411c4ce24c48c8ff3cdf7b48d237240
Headers show

Comments

Richard Genoud - Sept. 12, 2012, 12:26 p.m.
If override size is too big, the module was actually loaded instead of
failing, because retval was not set.

This lead to memory corruption with the use of the freed structs nandsim
and nand_chip.

Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
---
 drivers/mtd/nand/nandsim.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
Richard Genoud - Sept. 18, 2012, 8:27 a.m.
2012/9/12 Richard Genoud <richard.genoud@gmail.com>:
> If override size is too big, the module was actually loaded instead of
> failing, because retval was not set.
>
> This lead to memory corruption with the use of the freed structs nandsim
> and nand_chip.
>
> Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
> ---
>  drivers/mtd/nand/nandsim.c |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
> index cf0cd31..5d881180 100644
> --- a/drivers/mtd/nand/nandsim.c
> +++ b/drivers/mtd/nand/nandsim.c
> @@ -2333,6 +2333,7 @@ static int __init ns_init_module(void)
>                 uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
>                 if (new_size >> overridesize != nsmtd->erasesize) {
>                         NS_ERR("overridesize is too big\n");
> +                       retval = -EINVAL;
>                         goto err_exit;
>                 }
>                 /* N.B. This relies on nand_scan not doing anything with the size before we change it */
> --
> 1.7.2.5
>
Hi Artem, David.

As this is a bug fix, it should be pushed to 3.6-rc7, shouldn't it ?

Regards,
Richard.
Artem Bityutskiy - Sept. 25, 2012, 2:05 p.m.
On Wed, 2012-09-12 at 14:26 +0200, Richard Genoud wrote:
> If override size is too big, the module was actually loaded instead of
> failing, because retval was not set.
> 
> This lead to memory corruption with the use of the freed structs nandsim
> and nand_chip.
> 
> Signed-off-by: Richard Genoud <richard.genoud@gmail.com>

Pushed to l2-mtd.git, CCed -stable.
Artem Bityutskiy - Sept. 26, 2012, 9:52 a.m.
On Tue, 2012-09-18 at 10:27 +0200, Richard Genoud wrote:
> As this is a bug fix, it should be pushed to 3.6-rc7, shouldn't it ?

Well, it is a fix for an ancient bug, so it is enough to CC the stable
tree and merge this patch normally, I think.

Patch

diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index cf0cd31..5d881180 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2333,6 +2333,7 @@  static int __init ns_init_module(void)
 		uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
 		if (new_size >> overridesize != nsmtd->erasesize) {
 			NS_ERR("overridesize is too big\n");
+			retval = -EINVAL;
 			goto err_exit;
 		}
 		/* N.B. This relies on nand_scan not doing anything with the size before we change it */