From: Artem Bityutskiy Date: Sun, 16 Jan 2011 15:50:54 +0000 (+0200) Subject: mtd: mtdpart: disallow reading OOB past the end of the partition X-Git-Tag: v2.6.38-rc1~21^2 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=154bf89f5e3e3dc59666926f27ca4a0866f39157;p=pandora-kernel.git mtd: mtdpart: disallow reading OOB past the end of the partition This patch fixes the mtdpart bug which allows users reading OOB past the end of the partition. This happens because 'part_read_oob()' allows reading multiple OOB areas in one go, and mtdparts does not validate the OOB length in the request. Although there is such check in 'nand_do_read_oob()' in nand_base.c, but it checks that we do not read past the flash chip, not the partition, because in nand_base.c we work with the whole chip (e.g., mtd->size in nand_base.c is the size of the whole chip). So this check cannot be done correctly in nand_base.c and should be instead done in mtdparts.c. This problem was reported by Jason Liu and reproduced with nandsim: $ modprobe nandsim first_id_byte=0x20 second_id_byte=0xaa third_id_byte=0x00 \ fourth_id_byte=0x15 parts=0x400,0x400 $ modprobe nandsim mtd_oobtest.ko dev=0 $ dmesg = snip = mtd_oobtest: attempting to read past end of device mtd_oobtest: an error is expected... mtd_oobtest: error: read past end of device = snip = mtd_oobtest: finished with 2 errors Reported-by: Jason Liu Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse --- Reading git-diff-tree failed