ubi: Fix out of bounds write in volume update code

[pandora-kernel.git] / drivers / mtd / ubi / upd.c

diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 068a246..d1802b0 100644 (file)
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -197,7 +197,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol,
        vol->ch_lnum = req->lnum;
        vol->ch_dtype = req->dtype;
 
-       vol->upd_buf = vmalloc(req->bytes);
+       vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size));
        if (!vol->upd_buf)
                return -ENOMEM;