From: Greg Kroah-Hartman Date: Mon, 17 Apr 2023 17:37:12 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v4.14.313~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b3705ceba4543c716564a5debc2d6ccebcd45b1b;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: ubi-fix-failure-attaching-when-vid_hdr-offset-equals-to-sub-page-size.patch --- diff --git a/queue-6.1/series b/queue-6.1/series index 07c43b52a62..e42ba3f96c1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -115,3 +115,4 @@ drm-amd-pm-correct-smu13.0.7-pstate-profiling-clock-settings.patch drm-amd-pm-correct-smu13.0.7-max-shader-clock-reporting.patch mptcp-use-mptcp_schedule_work-instead-of-open-coding-it.patch mptcp-stricter-state-check-in-mptcp_worker.patch +ubi-fix-failure-attaching-when-vid_hdr-offset-equals-to-sub-page-size.patch diff --git a/queue-6.1/ubi-fix-failure-attaching-when-vid_hdr-offset-equals-to-sub-page-size.patch b/queue-6.1/ubi-fix-failure-attaching-when-vid_hdr-offset-equals-to-sub-page-size.patch new file mode 100644 index 00000000000..985ef642a92 --- /dev/null +++ b/queue-6.1/ubi-fix-failure-attaching-when-vid_hdr-offset-equals-to-sub-page-size.patch @@ -0,0 +1,73 @@ +From 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 Mon Sep 17 00:00:00 2001 +From: Zhihao Cheng +Date: Mon, 6 Mar 2023 09:33:08 +0800 +Subject: ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size + +From: Zhihao Cheng + +commit 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 upstream. + +Following process will make ubi attaching failed since commit +1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"): + +ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB +modprobe nandsim id_bytes=$ID +flash_eraseall /dev/mtd0 +modprobe ubi mtd="0,2048" # set vid_hdr offset as 2048 (one page) +(dmesg): + ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large. + UBI error: cannot attach mtd0 + UBI error: cannot initialize UBI, error -22 + +Rework original solution, the key point is making sure +'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize', +so we should check vid_hdr_shift rather not vid_hdr_offset. +Then, ubi still support (sub)page aligined VID header offset. + +Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size") +Signed-off-by: Zhihao Cheng +Tested-by: Nicolas Schichan +Tested-by: Miquel Raynal # v5.10, v4.19 +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/ubi/build.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -664,12 +664,6 @@ static int io_init(struct ubi_device *ub + ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size); + ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size); + +- if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) > +- ubi->vid_hdr_alsize)) { +- ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset); +- return -EINVAL; +- } +- + dbg_gen("min_io_size %d", ubi->min_io_size); + dbg_gen("max_write_size %d", ubi->max_write_size); + dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size); +@@ -687,6 +681,21 @@ static int io_init(struct ubi_device *ub + ubi->vid_hdr_aloffset; + } + ++ /* ++ * Memory allocation for VID header is ubi->vid_hdr_alsize ++ * which is described in comments in io.c. ++ * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds ++ * ubi->vid_hdr_alsize, so that all vid header operations ++ * won't access memory out of bounds. ++ */ ++ if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) { ++ ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)" ++ " + VID header size(%zu) > VID header aligned size(%d).", ++ ubi->vid_hdr_offset, ubi->vid_hdr_shift, ++ UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize); ++ return -EINVAL; ++ } ++ + /* Similar for the data offset */ + ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE; + ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);