Jann Horn 23bd97eaeb mtdchar: fix overflows in adjustment of count ...

[ Upstream commit 6c6bc9ea84 ]

The first checks in mtdchar_read() and mtdchar_write() attempt to limit
`count` such that `*ppos + count <= mtd->size`. However, they ignore the
possibility of `*ppos > mtd->size`, allowing the calculation of `count` to
wrap around. `mtdchar_lseek()` prevents seeking beyond mtd->size, but the
pread/pwrite syscalls bypass this.

I haven't found any codepath on which this actually causes dangerous
behavior, but it seems like a sensible change anyway.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-09-26 08:36:37 +02:00

..

chips

mtd: cfi_cmdset_0002: Change erase functions to check chip good only

2018-07-11 16:26:46 +02:00

devices

mtd: m25p80: consider max message size in m25p80_read

2018-07-22 14:27:35 +02:00

lpddr

mtd: lpddr: show parent device in sysfs

2015-10-13 09:21:17 -07:00

maps

mtd/maps: fix solutionengine.c printk format warnings

2018-09-26 08:36:32 +02:00

nand

mtd: nand: qcom: Add a NULL check for devm_kasprintf()

2018-08-15 18:14:43 +02:00

onenand

mtd: silence some uninitialized variable warnings

2016-07-09 18:14:39 -07:00

spi-nor

mtd: spi-nor: fix spansion quad enable

2017-06-29 13:00:31 +02:00

tests

mtd: mtd_oobtest: Handle bitflips during reads

2018-04-13 19:48:31 +02:00

ubi

mtd: ubi: wl: Fix error return code in ubi_wl_init()

2018-09-19 22:47:16 +02:00

afs.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

ar7part.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

bcm47xxpart.c

mtd: bcm47xxpart: fix parsing first block after aligned TRX

2017-04-18 07:11:47 +02:00

bcm63xxpart.c

mtd: bcm63xxpart: give width specifier an 'int', not 'size_t'

2016-03-07 13:13:58 -08:00

cmdlinepart.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

ftl.c

mtd: ftl: use swap() in copy_erase_unit()

2015-12-18 16:56:07 -08:00

inftlcore.c

mtd: nand: add a helper to detect the nand type

2013-10-27 16:27:06 -07:00

inftlmount.c

mtd: intflmount: fix off by one error in INFTL_dumpVUchains()

2014-11-05 13:19:21 -08:00

Kconfig

mtd: bcm63xxpart: Remove dependency on mach-bcm63xx

2016-02-12 10:27:48 -08:00

Makefile

mtd: spi-nor: shorten Kconfig naming

2014-04-14 11:23:01 -07:00

mtd_blkdevs.c

block: convert to device_add_disk()

2016-06-27 12:26:08 -07:00

mtdblock_ro.c

mtd: Move major number definitions to major.h

2013-11-06 23:32:59 -08:00

mtdblock.c

mtd: mtdblock: remove the needless mtdblks_lock

2015-01-07 12:51:56 -08:00

mtdchar.c

mtdchar: fix overflows in adjustment of count

2018-09-26 08:36:37 +02:00

mtdconcat.c

mtd: create an mtd_ooblayout_ops struct to ease ECC layout definition

2016-04-19 22:05:55 +02:00

mtdcore.c

treewide: remove redundant #include <linux/kconfig.h>

2016-10-11 15:06:33 -07:00

mtdcore.h

mtd: partitions: support a cleanup callback for parsers

2015-12-09 14:57:44 -08:00

mtdoops.c

mtdoops: don't erase flash at each boot

2012-11-15 15:37:51 +02:00

mtdpart.c

treewide: remove redundant #include <linux/kconfig.h>

2016-10-11 15:06:33 -07:00

mtdsuper.c

mtd: Move major number definitions to major.h

2013-11-06 23:32:59 -08:00

mtdswap.c

mtd: mtdswap: remove useless if (!mtd->ecclayout) test

2016-03-07 16:23:09 -08:00

nftlcore.c

mtd: nand: add a helper to detect the nand type

2013-10-27 16:27:06 -07:00

nftlmount.c

mtd: nftl: reorganize operations in condition check

2015-01-09 15:26:29 -08:00

ofpart.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

redboot.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

rfd_ftl.c

mtd: remove some duplicative checks

2014-03-10 22:42:25 -07:00

sm_ftl.c

treewide: Fix typos in printk

2016-04-18 11:23:24 +02:00

sm_ftl.h

mtd: sm_ftl: cosmetic, use bool when possible

2010-10-25 01:33:08 +01:00

ssfdc.c

mtd: Replace if and BUG with BUG_ON

2016-07-09 18:48:54 -07:00