[PATCH] ubi: ensure that VID header offset + VID header size <= alloc, size

[Richard Weinberger]

----- Ursprüngliche Mail -----
> Fixes: 801c135ce73d ("UBI: Unsorted Block Images")
> Reported-by: syzkaller <syzkaller at googlegroups.com>
> Signed-off-by: George Kennedy <george.kennedy at oracle.com>
> ---
>  drivers/mtd/ubi/build.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index a32050fecabf..53aa4de6b963 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -663,6 +663,12 @@ static int io_init(struct ubi_device *ubi, int
> max_beb_per1024)
>  	ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
>  	ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
>  
> +	if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
> +	    ubi->vid_hdr_alsize)) {
> +		ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
> +		return -EINVAL;
> +	}
> +

Thanks for fixing this, applied to the fixes branch.
That said, something broke whitespaces in your patch, I applied it manually.
Context lines before and after contain an extra space and caused both
git am and patch to give up.

Thanks,
//richard