]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
mtd: partitions: redboot: Added conversion of operands to a larger type
authorDenis Arefev <arefev@swemel.ru>
Fri, 15 Mar 2024 09:37:58 +0000 (12:37 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 5 Jul 2024 07:08:27 +0000 (09:08 +0200)
[ Upstream commit 1162bc2f8f5de7da23d18aa4b7fbd4e93c369c50 ]

The value of an arithmetic expression directory * master->erasesize is
subject to overflow due to a failure to cast operands to a larger data
type before perfroming arithmetic

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Arefev <arefev@swemel.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20240315093758.20790-1-arefev@swemel.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/mtd/parsers/redboot.c

index 4f3bcc59a6385e7cdae9e47039fe877f1f855d1c..3351be651473202747c72264987e9b519a712e7d 100644 (file)
@@ -102,7 +102,7 @@ static int parse_redboot_partitions(struct mtd_info *master,
                        offset -= master->erasesize;
                }
        } else {
-               offset = directory * master->erasesize;
+               offset = (unsigned long) directory * master->erasesize;
                while (mtd_block_isbad(master, offset)) {
                        offset += master->erasesize;
                        if (offset == master->size)