A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user

Browse source 
When calculating the size needed by struct atmel_pmecc_user *user,
the dmu and delta buffer sizes were forgotten.
This lead to a memory corruption (especially with a large ecc_strength).

Link: http://lkml.kernel.org/r/[email protected]
Fixes: f88fc122cc ("mtd: nand: Cleanup/rework the atmel_nand driver")
Cc: [email protected]
Reported-by: Richard Genoud <[email protected]>
Pointed-at-by: Boris Brezillon <[email protected]>
Signed-off-by: Richard Genoud <[email protected]>
Reviewed-by: Nicolas Ferre <[email protected]>
Signed-off-by: Boris Brezillon <[email protected]>
This commit is contained in:
Richard Genoud 2017-09-27 14:49:17 +02:00 • committed by Boris Brezillon
commit 36de807400
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/mtd/nand/atmel/pmecc.c
View file

@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
size += (req->ecc.strength + 1) * sizeof(u16);
/* Reserve space for mu, dmu and delta. */
size = ALIGN(size, sizeof(s32));
size += (req->ecc.strength + 1) * sizeof(s32);
size += (req->ecc.strength + 1) * sizeof(s32) * 3;
user = kzalloc(size, GFP_KERNEL);
if (!user)