From patchwork Wed Sep 12 12:26:26 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: MTD: nandsim: BUG: Fail if overridesize is too big Date: Wed, 12 Sep 2012 02:26:26 -0000 From: Richard Genoud X-Patchwork-Id: 183353 Message-Id: <1347452786-10208-1-git-send-email-richard.genoud@gmail.com> To: David Woodhouse , Artem Bityutskiy Cc: Richard Genoud , linux-mtd@lists.infradead.org, Adrian Hunter If override size is too big, the module was actually loaded instead of failing, because retval was not set. This lead to memory corruption with the use of the freed structs nandsim and nand_chip. Signed-off-by: Richard Genoud --- drivers/mtd/nand/nandsim.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c index cf0cd31..5d881180 100644 --- a/drivers/mtd/nand/nandsim.c +++ b/drivers/mtd/nand/nandsim.c @@ -2333,6 +2333,7 @@ static int __init ns_init_module(void) uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize; if (new_size >> overridesize != nsmtd->erasesize) { NS_ERR("overridesize is too big\n"); + retval = -EINVAL; goto err_exit; } /* N.B. This relies on nand_scan not doing anything with the size before we change it */