Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1352298
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.10 23/24] ubi: Fix out of bounds write in volume update code |
| Date | 2016-03-08 01:00 +0100 |
| Message-ID | <radeb-1go-47@gated-at.bofh.it> (permalink) |
| References | <rad4t-1cJ-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Richard Weinberger <richard@nod.at> commit e4f6daac20332448529b11f09388f1d55ef2084c upstream. ubi_start_leb_change() allocates too few bytes. ubi_more_leb_change_data() will write up to req->upd_bytes + ubi->min_io_size bytes. Signed-off-by: Richard Weinberger <richard@nod.at> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/mtd/ubi/upd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/mtd/ubi/upd.c +++ b/drivers/mtd/ubi/upd.c @@ -193,7 +193,7 @@ int ubi_start_leb_change(struct ubi_devi vol->changing_leb = 1; vol->ch_lnum = req->lnum; - vol->upd_buf = vmalloc(req->bytes); + vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size)); if (!vol->upd_buf) return -ENOMEM;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.10 00/24] 3.10.100-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 00:50 +0100 [PATCH 3.10 12/24] ALSA: ctl: Fix ioctls for X32 ABI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 00:50 +0100 [PATCH 3.10 09/24] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 00:50 +0100 [PATCH 3.10 22/24] USB: serial: option: add support for Quectel UC20 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 00:50 +0100 [PATCH 3.10 21/24] USB: serial: option: add support for Telit LE922 PID 0x1045 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 00:50 +0100 [PATCH 3.10 15/24] ALSA: seq: oss: Dont drain at closing a client Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 00:50 +0100 [PATCH 3.10 23/24] ubi: Fix out of bounds write in volume update code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:00 +0100 [PATCH 3.10 07/24] libata: Align ata_devices id on a cacheline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 [PATCH 3.10 04/24] x86/entry/compat: Add missing CLAC to entry_INT80_32 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 [PATCH 3.10 08/24] PM / sleep / x86: Fix crash on graph trace through x86 suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 [PATCH 3.10 03/24] CIFS: Fix SMB2+ interim response processing for read requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 [PATCH 3.10 02/24] EDAC, mc_sysfs: Fix freeing bus name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 [PATCH 3.10 13/24] ALSA: rawmidi: Fix ioctls X32 ABI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 [PATCH 3.10 06/24] libata: fix HDIO_GET_32BIT ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-08 01:10 +0100 Re: [PATCH 3.10 00/24] 3.10.100-stable review Guenter Roeck <linux@roeck-us.net> - 2016-03-08 12:50 +0100 Re: [PATCH 3.10 00/24] 3.10.100-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-03-08 17:30 +0100
csiph-web