diff options
author | Will Newton | 2012-03-30 12:51:02 +0200 |
---|---|---|
committer | David Woodhouse | 2012-05-07 21:29:50 +0200 |
commit | 7a84477c4acebf6299b6a8bd6a1d5894eb838ffa (patch) | |
tree | 7ead0857a87874bb3362953d5fb55749f88903de /fs/jffs2 | |
parent | Linux 3.4-rc4 (diff) | |
download | kernel-qcow2-linux-7a84477c4acebf6299b6a8bd6a1d5894eb838ffa.tar.gz kernel-qcow2-linux-7a84477c4acebf6299b6a8bd6a1d5894eb838ffa.tar.xz kernel-qcow2-linux-7a84477c4acebf6299b6a8bd6a1d5894eb838ffa.zip |
mtd: fix oops in dataflash driver
I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
with -1 for offset and length and a NULL buffer to test if OTP
operations are supported. This finds its way down to otp_read in
mtd_dataflash.c and causes an oops when memcpying the returned data
into the NULL buf.
None of the checks in otp_read catches the negative length and offset.
Changing the length of the dummy read to 0 prevents the oops.
Cc: stable@kernel.org [3.3+]
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'fs/jffs2')
0 files changed, 0 insertions, 0 deletions