mtd: mtdpart: disallow reading OOB past the end of the partition

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=154bf89f5e3e3dc59666926f27ca4a0866f39157
Commit:     154bf89f5e3e3dc59666926f27ca4a0866f39157
Parent:     52d039fdaa78c5a9f9bc2940ad58d7ed76b8336d
Author:     Artem Bityutskiy <Artem.Bityutskiy at nokia.com>
AuthorDate: Sun Jan 16 17:50:54 2011 +0200
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Mon Jan 17 15:25:48 2011 +0000

    mtd: mtdpart: disallow reading OOB past the end of the partition
    
    This patch fixes the mtdpart bug which allows users reading OOB past the
    end of the partition. This happens because 'part_read_oob()' allows reading
    multiple OOB areas in one go, and mtdparts does not validate the OOB
    length in the request.
    
    Although there is such check in 'nand_do_read_oob()' in nand_base.c, but
    it checks that we do not read past the flash chip, not the partition,
    because in nand_base.c we work with the whole chip (e.g., mtd->size
    in nand_base.c is the size of the whole chip). So this check cannot
    be done correctly in nand_base.c and should be instead done in mtdparts.c.
    
    This problem was reported by Jason Liu <r64343 at freescale.com> and reproduced
    with nandsim:
    
    $ modprobe nandsim first_id_byte=0x20 second_id_byte=0xaa third_id_byte=0x00 \
                       fourth_id_byte=0x15 parts=0x400,0x400
    $ modprobe nandsim mtd_oobtest.ko dev=0
    $ dmesg
    = snip =
    mtd_oobtest: attempting to read past end of device
    mtd_oobtest: an error is expected...
    mtd_oobtest: error: read past end of device
    = snip =
    mtd_oobtest: finished with 2 errors
    
    Reported-by: Jason Liu <liu.h.jason at gmail.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at nokia.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/mtdpart.c |   19 ++++++++++++++++++-
 1 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index b910a37..0a47601 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -120,8 +120,25 @@ static int part_read_oob(struct mtd_info *mtd, loff_t from,
 		return -EINVAL;
 	if (ops->datbuf && from + ops->len > mtd->size)
 		return -EINVAL;
-	res = part->master->read_oob(part->master, from + part->offset, ops);
 
+	/*
+	 * If OOB is also requested, make sure that we do not read past the end
+	 * of this partition.
+	 */
+	if (ops->oobbuf) {
+		size_t len, pages;
+
+		if (ops->mode == MTD_OOB_AUTO)
+			len = mtd->oobavail;
+		else
+			len = mtd->oobsize;
+		pages = mtd_div_by_ws(mtd->size, mtd);
+		pages -= mtd_div_by_ws(from, mtd);
+		if (ops->ooboffs + ops->ooblen > pages * len)
+			return -EINVAL;
+	}
+
+	res = part->master->read_oob(part->master, from + part->offset, ops);
 	if (unlikely(res)) {
 		if (res == -EUCLEAN)
 			mtd->ecc_stats.corrected++;