| Message ID | 20161221232528.26534-1-Jason@zx2c4.com |
|---|---|
| State | Changes Requested |
| Headers | show |
On 12/22/2016 12:25 AM, Jason A. Donenfeld wrote: > By giving a bogus partition name, it's possible to trigger a null > pointer dereference. > > Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Nice catch. It'd be great to have the condition which can be used to trigger this problem in the commit message. I presume this happens if buf[i].name[0] = 0xff for all $i, right ? So please expand the explanation and add my Ack for V2: Acked-by: Marek Vasut <marek.vasut@gmail.com> Thanks > --- > drivers/mtd/redboot.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c > index 7623ac5fc586..53949ef80d36 100644 > --- a/drivers/mtd/redboot.c > +++ b/drivers/mtd/redboot.c > @@ -212,6 +212,10 @@ static int parse_redboot_partitions(struct mtd_info *master, > > nrparts++; > } > + if (!fl) { > + ret = -EINVAL; > + goto out; > + } > #ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED > if (fl->img->flash_base) { > nrparts++; >
diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c index 7623ac5fc586..53949ef80d36 100644 --- a/drivers/mtd/redboot.c +++ b/drivers/mtd/redboot.c @@ -212,6 +212,10 @@ static int parse_redboot_partitions(struct mtd_info *master, nrparts++; } + if (!fl) { + ret = -EINVAL; + goto out; + } #ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED if (fl->img->flash_base) { nrparts++;
By giving a bogus partition name, it's possible to trigger a null pointer dereference. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> --- drivers/mtd/redboot.c | 4 ++++ 1 file changed, 4 insertions(+)