diff options
| author | Richard Weinberger <richard@nod.at> | 2016-02-21 10:53:03 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2016-04-01 01:54:37 +0100 |
| commit | 7aae79649d6a88e7104d4d22aa4ba21f4e699e40 (patch) | |
| tree | 7022c733bf7892534bd7238054c8c134c2844c70 | |
| parent | 5476a24d66a7d275ed1e0a3113f26c1158684462 (diff) | |
ubi: Fix out of bounds write in volume update code
commit e4f6daac20332448529b11f09388f1d55ef2084c upstream.
ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/mtd/ubi/upd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c index 068a2466d060..d1802b054bfe 100644 --- a/drivers/mtd/ubi/upd.c +++ b/drivers/mtd/ubi/upd.c @@ -197,7 +197,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol, vol->ch_lnum = req->lnum; vol->ch_dtype = req->dtype; - vol->upd_buf = vmalloc(req->bytes); + vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size)); if (!vol->upd_buf) return -ENOMEM; |