From 87b275205dc27b1190e972df17951c139a320c4a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 17 Oct 2015 16:53:25 -0700 Subject: [PATCH] 3.14-stable patches added patches: ubi-return-enospc-if-no-enough-space-available.patch ubi-validate-data_size.patch --- queue-3.14/series | 2 + ...-enospc-if-no-enough-space-available.patch | 50 +++++++++++++++++++ queue-3.14/ubi-validate-data_size.patch | 35 +++++++++++++ 3 files changed, 87 insertions(+) create mode 100644 queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch create mode 100644 queue-3.14/ubi-validate-data_size.patch diff --git a/queue-3.14/series b/queue-3.14/series index 31efa5d0c5c..f0ff9611acd 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -63,3 +63,5 @@ staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch md-flush-event_work-before-stopping-array.patch powerpc-msi-fix-race-condition-in-tearing-down-msi-interrupts.patch +ubi-validate-data_size.patch +ubi-return-enospc-if-no-enough-space-available.patch diff --git a/queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch b/queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch new file mode 100644 index 00000000000..23ae630ddd0 --- /dev/null +++ b/queue-3.14/ubi-return-enospc-if-no-enough-space-available.patch @@ -0,0 +1,50 @@ +From 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 Mon Sep 17 00:00:00 2001 +From: shengyong +Date: Mon, 28 Sep 2015 17:57:19 +0000 +Subject: UBI: return ENOSPC if no enough space available + +From: shengyong + +commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream. + +UBI: attaching mtd1 to ubi0 +UBI: scanning is finished +UBI error: init_volumes: not enough PEBs, required 706, available 686 +UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1) +UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 <= NOT ENOMEM +UBI error: ubi_init: cannot attach mtd1 + +If available PEBs are not enough when initializing volumes, return -ENOSPC +directly. If available PEBs are not enough when initializing WL, return +-ENOSPC instead of -ENOMEM. + +Signed-off-by: Sheng Yong +Signed-off-by: Richard Weinberger +Reviewed-by: David Gstir +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/vtbl.c | 1 + + drivers/mtd/ubi/wl.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/mtd/ubi/vtbl.c ++++ b/drivers/mtd/ubi/vtbl.c +@@ -651,6 +651,7 @@ static int init_volumes(struct ubi_devic + if (ubi->corr_peb_count) + ubi_err("%d PEBs are corrupted and not used", + ubi->corr_peb_count); ++ return -ENOSPC; + } + ubi->rsvd_pebs += reserved_pebs; + ubi->avail_pebs -= reserved_pebs; +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -1974,6 +1974,7 @@ int ubi_wl_init(struct ubi_device *ubi, + if (ubi->corr_peb_count) + ubi_err("%d PEBs are corrupted and not used", + ubi->corr_peb_count); ++ err = -ENOSPC; + goto out_free; + } + ubi->avail_pebs -= reserved_pebs; diff --git a/queue-3.14/ubi-validate-data_size.patch b/queue-3.14/ubi-validate-data_size.patch new file mode 100644 index 00000000000..406ed4fc605 --- /dev/null +++ b/queue-3.14/ubi-validate-data_size.patch @@ -0,0 +1,35 @@ +From 281fda27673f833a01d516658a64d22a32c8e072 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Tue, 22 Sep 2015 23:58:07 +0200 +Subject: UBI: Validate data_size + +From: Richard Weinberger + +commit 281fda27673f833a01d516658a64d22a32c8e072 upstream. + +Make sure that data_size is less than LEB size. +Otherwise a handcrafted UBI image is able to trigger +an out of bounds memory access in ubi_compare_lebs(). + +Signed-off-by: Richard Weinberger +Reviewed-by: David Gstir +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/io.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/mtd/ubi/io.c ++++ b/drivers/mtd/ubi/io.c +@@ -921,6 +921,11 @@ static int validate_vid_hdr(const struct + goto bad; + } + ++ if (data_size > ubi->leb_size) { ++ ubi_err("bad data_size"); ++ goto bad; ++ } ++ + if (vol_type == UBI_VID_STATIC) { + /* + * Although from high-level point of view static volumes may -- 2.47.3