Fixes for 4.14

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/series b/queue-4.14/series
index 7afd9440b80561bfa92a88821764a84436bdde9c..730c0d95e8b209d6518fa3e81066457ebb90072d 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -28,3 +28,4 @@ net-macb-fix-a-memory-corruption-in-extended-buffer-.patch
 i2c-imx-lpi2c-clean-rx-tx-buffers-upon-new-message.patch
 efi-sysfb_efi-add-quirk-for-lenovo-yoga-book-x91f-l.patch
 verify_pefile-relax-wrapper-length-check.patch
+ubi-fix-failure-attaching-when-vid_hdr-offset-equals.patch

diff --git a/queue-4.14/ubi-fix-failure-attaching-when-vid_hdr-offset-equals.patch b/queue-4.14/ubi-fix-failure-attaching-when-vid_hdr-offset-equals.patch
new file mode 100644 (file)
index 0000000..ad62c7c
--- /dev/null
+++ b/queue-4.14/ubi-fix-failure-attaching-when-vid_hdr-offset-equals.patch
@@ -0,0 +1,79 @@
+From bbe3dbb665806c6b077f30f0d78f1baba48afd64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 09:33:08 +0800
+Subject: ubi: Fix failure attaching when vid_hdr offset equals to (sub)page
+ size
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 ]
+
+Following process will make ubi attaching failed since commit
+1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"):
+
+ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB
+modprobe nandsim id_bytes=$ID
+flash_eraseall /dev/mtd0
+modprobe ubi mtd="0,2048"  # set vid_hdr offset as 2048 (one page)
+(dmesg):
+  ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large.
+  UBI error: cannot attach mtd0
+  UBI error: cannot initialize UBI, error -22
+
+Rework original solution, the key point is making sure
+'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize',
+so we should check vid_hdr_shift rather not vid_hdr_offset.
+Then, ubi still support (sub)page aligined VID header offset.
+
+Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Tested-by: Nicolas Schichan <nschichan@freebox.fr>
+Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> # v5.10, v4.19
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index c6765210a6fc8..4ee1ff84076dc 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -648,12 +648,6 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+       ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
+       ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
+ 
+-      if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
+-          ubi->vid_hdr_alsize)) {
+-              ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
+-              return -EINVAL;
+-      }
+-
+       dbg_gen("min_io_size      %d", ubi->min_io_size);
+       dbg_gen("max_write_size   %d", ubi->max_write_size);
+       dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size);
+@@ -671,6 +665,21 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+                                               ubi->vid_hdr_aloffset;
+       }
+ 
++      /*
++       * Memory allocation for VID header is ubi->vid_hdr_alsize
++       * which is described in comments in io.c.
++       * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds
++       * ubi->vid_hdr_alsize, so that all vid header operations
++       * won't access memory out of bounds.
++       */
++      if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) {
++              ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)"
++                      " + VID header size(%zu) > VID header aligned size(%d).",
++                      ubi->vid_hdr_offset, ubi->vid_hdr_shift,
++                      UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize);
++              return -EINVAL;
++      }
++
+       /* Similar for the data offset */
+       ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE;
+       ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);
+-- 
+2.39.2
+