mtd: fix oops in dataflash driver

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=7a84477c4acebf6299b6a8bd6a1d5894eb838ffa
Commit:     7a84477c4acebf6299b6a8bd6a1d5894eb838ffa
Parent:     66f75a5d028beaf67c931435fdc3e7823125730c
Author:     Will Newton <will.newton at gmail.com>
AuthorDate: Fri Mar 30 11:51:02 2012 +0100
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Mon May 7 20:29:50 2012 +0100

    mtd: fix oops in dataflash driver
    
    I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
    be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
    with -1 for offset and length and a NULL buffer to test if OTP
    operations are supported. This finds its way down to otp_read in
    mtd_dataflash.c and causes an oops when memcpying the returned data
    into the NULL buf.
    
    None of the checks in otp_read catches the negative length and offset.
    Changing the length of the dummy read to 0 prevents the oops.
    
    Cc: stable at kernel.org [3.3+]
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/mtdchar.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 58fc65f..f2f482b 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -376,7 +376,7 @@ static int otp_select_filemode(struct mtd_file_info *mfi, int mode)
 	 * Make a fake call to mtd_read_fact_prot_reg() to check if OTP
 	 * operations are supported.
 	 */
-	if (mtd_read_fact_prot_reg(mtd, -1, -1, &retlen, NULL) == -EOPNOTSUPP)
+	if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == -EOPNOTSUPP)
 		return -EOPNOTSUPP;
 
 	switch (mode) {