From: Will Newton <will.newton@gmail.com>
Date: Fri, 30 Mar 2012 10:51:02 +0000 (+0100)
Subject: mtd: fix oops in dataflash driver
X-Git-Tag: v3.4~33^2~2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7a84477c4acebf6299b6a8bd6a1d5894eb838ffa;p=pandora-kernel.git

mtd: fix oops in dataflash driver

I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
with -1 for offset and length and a NULL buffer to test if OTP
operations are supported. This finds its way down to otp_read in
mtd_dataflash.c and causes an oops when memcpying the returned data
into the NULL buf.

None of the checks in otp_read catches the negative length and offset.
Changing the length of the dummy read to 0 prevents the oops.

Cc: stable@kernel.org [3.3+]
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
---

Reading git-diff-tree failed