mtd: nandsim: bugfix: fail if overridesize is too big

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=bb0a13a13411c4ce24c48c8ff3cdf7b48d237240
Commit:     bb0a13a13411c4ce24c48c8ff3cdf7b48d237240
Parent:     5bf3d66a933efb71fa6db08a5043a617b6eadb4a
Author:     Richard Genoud <richard.genoud at gmail.com>
AuthorDate: Wed Sep 12 14:26:26 2012 +0200
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Sat Sep 29 15:54:12 2012 +0100

    mtd: nandsim: bugfix: fail if overridesize is too big
    
    If override size is too big, the module was actually loaded instead of
    failing, because retval was not set.
    
    This lead to memory corruption with the use of the freed structs nandsim
    and nand_chip.
    
    Cc: stable at vger.kernel.org
    Signed-off-by: Richard Genoud <richard.genoud at gmail.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/nand/nandsim.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 21e64b5..a932c48 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2317,6 +2317,7 @@ static int __init ns_init_module(void)
 		uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
 		if (new_size >> overridesize != nsmtd->erasesize) {
 			NS_ERR("overridesize is too big\n");
+			retval = -EINVAL;
 			goto err_exit;
 		}
 		/* N.B. This relies on nand_scan not doing anything with the size before we change it */