3.14-stable patches

added patches:
	ubi-return-enospc-if-no-enough-space-available.patch
	ubi-validate-data_size.patch

diff --git a/queue-3.14/series b/queue-3.14/series
index 31efa5d0c5c6f51e39589537f3d77a663117a4dc..f0ff9611acdc5f304de29168cd8cd4535d482535 100644 (file)
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -63,3 +63,5 @@ staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch
 staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch
 md-flush-event_work-before-stopping-array.patch
 powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch
+ubi-validate-data_size.patch
+ubi-return-enospc-if-no-enough-space-available.patch

diff --git a/queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch b/queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch
new file mode 100644 (file)
index 0000000..23ae630
--- /dev/null
+++ b/queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch
@@ -0,0 +1,50 @@
+From 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 Mon Sep 17 00:00:00 2001
+From: shengyong <shengyong1@huawei.com>
+Date: Mon, 28 Sep 2015 17:57:19 +0000
+Subject: UBI: return ENOSPC if no enough space available
+
+From: shengyong <shengyong1@huawei.com>
+
+commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream.
+
+UBI: attaching mtd1 to ubi0
+UBI: scanning is finished
+UBI error: init_volumes: not enough PEBs, required 706, available 686
+UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1)
+UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 <= NOT ENOMEM
+UBI error: ubi_init: cannot attach mtd1
+
+If available PEBs are not enough when initializing volumes, return -ENOSPC
+directly. If available PEBs are not enough when initializing WL, return
+-ENOSPC instead of -ENOMEM.
+
+Signed-off-by: Sheng Yong <shengyong1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: David Gstir <david@sigma-star.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/vtbl.c |    1 +
+ drivers/mtd/ubi/wl.c   |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -651,6 +651,7 @@ static int init_volumes(struct ubi_devic
+               if (ubi->corr_peb_count)
+                       ubi_err("%d PEBs are corrupted and not used",
+                               ubi->corr_peb_count);
++              return -ENOSPC;
+       }
+       ubi->rsvd_pebs += reserved_pebs;
+       ubi->avail_pebs -= reserved_pebs;
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1974,6 +1974,7 @@ int ubi_wl_init(struct ubi_device *ubi,
+               if (ubi->corr_peb_count)
+                       ubi_err("%d PEBs are corrupted and not used",
+                               ubi->corr_peb_count);
++              err = -ENOSPC;
+               goto out_free;
+       }
+       ubi->avail_pebs -= reserved_pebs;

diff --git a/queue-3.14/ubi-validate-data_size.patch b/queue-3.14/ubi-validate-data_size.patch
new file mode 100644 (file)
index 0000000..406ed4f
--- /dev/null
+++ b/queue-3.14/ubi-validate-data_size.patch
@@ -0,0 +1,35 @@
+From 281fda27673f833a01d516658a64d22a32c8e072 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Tue, 22 Sep 2015 23:58:07 +0200
+Subject: UBI: Validate data_size
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.
+
+Make sure that data_size is less than LEB size.
+Otherwise a handcrafted UBI image is able to trigger
+an out of bounds memory access in ubi_compare_lebs().
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: David Gstir <david@sigma-star.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/io.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/mtd/ubi/io.c
++++ b/drivers/mtd/ubi/io.c
+@@ -921,6 +921,11 @@ static int validate_vid_hdr(const struct
+               goto bad;
+       }
+ 
++      if (data_size > ubi->leb_size) {
++              ubi_err("bad data_size");
++              goto bad;
++      }
++
+       if (vol_type == UBI_VID_STATIC) {
+               /*
+                * Although from high-level point of view static volumes may