mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user
PATCH 1/1 mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user
When calculating the size needed by struct atmel_pmecc_user *user, the dmu and delta buffer sizes were forgotten.
This lead to a memory corruption (especially with a large ecc_strength).
--- drivers/mtd/nand/atmel/pmecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/atmel/pmecc.c +1 -1
@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, size += (req->ecc.strength +1 ) *sizeof (u16);/* Reserve space for mu, dmu and delta. */ size =ALIGN (size,sizeof (s32)); - size += (req->ecc.strength +1 ) *sizeof (s32); + size += (req->ecc.strength +1 ) *sizeof (s32) *3 ; user =kzalloc (size,GFP_KERNEL );if (!user)
Quoted 7 lines · Richard Genoud
When calculating the size needed by struct
atmel_pmecc_user*user, the dmu and delta buffer sizes were forgotten.
This lead to a memory corruption (especially with a largeecc_strength).Fixes f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")Cc Nicolas Ferre <[email protected]>
Yes:
Thanks Richard and Boris for this quick fix!
Regards,
Nicolas
Quoted 22 lines
Reported-by Richard Genoud <[email protected]>Pointed-at-by Boris Brezillon <[email protected]>Signed-off-by Richard Genoud <[email protected]>--- drivers/mtd/nand/atmel/pmecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/mtd/nand/atmel/pmecc.c +1
-1@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, size += (req->ecc.strength +1 ) *sizeof (u16);/* Reserve space for mu, dmu and delta. */ size =ALIGN (size,sizeof (s32)); - size += (req->ecc.strength +1 ) *sizeof (s32); + size += (req->ecc.strength +1 ) *sizeof (s32) *3 ; user =kzalloc (size,GFP_KERNEL );if (!user)
Signature · 1 line
Nicolas Ferre
Boris Brezillon
AppliedQuoted 11 lines · On Wed, 27 Sep 2017 14:49:17 +0200 Richard Genoud <[email protected]>…
When calculating the size needed by struct
atmel_pmecc_user*user, the dmu and delta buffer sizes were forgotten.
This lead to a memory corruption (especially with a largeecc_strength).Fixes f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")Cc Nicolas Ferre <[email protected]>Reported-by Richard Genoud <[email protected]>Pointed-at-by Boris Brezillon <[email protected]>Signed-off-by Richard Genoud <[email protected]>
Applied.
Thanks,
Boris
Quoted 21 lines
--- drivers/mtd/nand/atmel/pmecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/mtd/nand/atmel/pmecc.c +1
-1@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, size += (req->ecc.strength +1 ) *sizeof (u16);/* Reserve space for mu, dmu and delta. */ size =ALIGN (size,sizeof (s32)); - size += (req->ecc.strength +1 ) *sizeof (s32); + size += (req->ecc.strength +1 ) *sizeof (s32) *3 ; user =kzalloc (size,GFP_KERNEL );if (!user)______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/