mtd mtdsplit-fit: fix fit not found case

Attempting to parse the mtdsplit-fit device can lead in a out of bounds
read error, as the driver did not validate a fit was found at all.

This can happen if the fit size in the header at the last scan iteration
is non-zero. In this case, the dmesg reads:

[    6.563676] Creating 6 MTD partitions on "ec000000.nor":
[    6.569058] 0x000000000000-0x000003d60000 : "firmware"
[    6.579192] read error in "firmware" at offset 0x3d60000
[    6.584534] Failed to parse subpartitions: -22
[    6.589010] Deleting MTD partitions on "ec000000.nor":

Validate after the scan loop if a fit image was found and abort in this
stage if it is not found.

Signed-off-by: David Bauer <mail@david-bauer.net>

diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
index 2afc19d09f4262cabec7eca3a3d9a6120a0d9c6f..276e9fc9e1ebcf9038ae4076414ea96bfe83a969 100644 (file)
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
@@ -206,6 +206,7 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
        struct mtd_partition *parts;
        int ret, ndepth, noffset, images_noffset;
        const void *img_data;
+       bool found_fit = false;
        void *fit;
 
        of_property_read_string(np, "openwrt,cmdline-match", &cmdline_match);
@@ -238,9 +239,15 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
                }
 
                /* We found a FIT image. Let's keep going */
+               found_fit = true;
                break;
        }
 
+       if (!found_fit) {
+               pr_info("No FIT image found in \"%s\"\n", mtd->name);
+               return -ENOENT;
+       }
+
        fit_offset = offset;
        fit_size = be32_to_cpu(hdr.totalsize);