kernel/git/stable/linux.git/drivers/mtd/mtdchar.c, branch linux-3.18.y

mtdchar: fix overflows in adjustment of `count`

2018-09-26T06:33:58+00:00

[ Upstream commit 6c6bc9ea84d0008024606bf5ba10519e20d851bf ] The first checks in mtdchar_read() and mtdchar_write() attempt to limit `count` such that `*ppos + count <= mtd->size`. However, they ignore the possibility of `*ppos > mtd->size`, allowing the calculation of `count` to wrap around. `mtdchar_lseek()` prevents seeking beyond mtd->size, but the pread/pwrite syscalls bypass this. I haven't found any codepath on which this actually causes dangerous behavior, but it seems like a sensible change anyway. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jann Horn Signed-off-by: Boris Brezillon Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

mtd: terminate user-provided string

2014-08-19T18:53:09+00:00

Noticed by Coverity as a potential security issue. Signed-off-by: Brian Norris

mtd: Fix warning in access_ok() parameter passing

2014-05-20T23:35:29+00:00

On m68k, where access_ok() doesn't cast the address parameter: drivers/mtd/mtdchar.c: In function 'mtdchar_write_ioctl': drivers/mtd/mtdchar.c:575:4: warning: passing argument 2 of 'access_ok' makes pointer from integer without a cast [enabled by default] arch/m68k/include/asm/uaccess_mm.h:17:90: note: expected 'const void *' but argument is of type '__u64' drivers/mtd/mtdchar.c:576:4: warning: passing argument 2 of 'access_ok' makes pointer from integer without a cast [enabled by default] arch/m68k/include/asm/uaccess_mm.h:17:90: note: expected 'const void *' but argument is of type '__u64' The address parameter of access_ok() is really a userspace pointer. On most architectures, access_ok() is a macro that casts the address parameter, hiding issues in its users. Move around and use the existing usr_data and usr_oob temporary variables to kill the warnings. Add a few "consts", and make more use of the temporaries while we're at it. Signed-off-by: Geert Uytterhoeven Signed-off-by: Brian Norris

mtd: Fix the behavior of OTP write if there is not enough room for data

2014-03-11T05:42:31+00:00

If a write to one time programmable memory (OTP) hits the end of this memory area, no more data can be written. The count variable in mtdchar_write() in drivers/mtd/mtdchar.c is not decreased anymore. We are trapped in the loop forever, mtdchar_write() will never return in this case. The desired behavior of a write in such a case is described in [1]: - Try to write as much data as possible, truncate the write to fit into the available memory and return the number of bytes that actually have been written. - If no data could be written at all, return -ENOSPC. This patch fixes the behavior of OTP write if there is not enough space for all data: 1) mtd_write_user_prot_reg() in drivers/mtd/mtdcore.c is modified to return -ENOSPC if no data could be written at all. 2) mtdchar_write() is modified to handle -ENOSPC correctly. Exit if a write returned -ENOSPC and yield the correct return value, either then number of bytes that could be written, or -ENOSPC, if no data could be written at all. Furthermore the patch harmonizes the behavior of the OTP memory write in drivers/mtd/devices/mtd_dataflash.c with the other implementations and the requirements from [1]. Instead of returning -EINVAL if the data does not fit into the OTP memory, we try to write as much data as possible/truncate the write. [1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/write.html Signed-off-by: Christian Riesch Signed-off-by: Brian Norris

mtd: Add a retlen parameter to _get_{fact,user}_prot_info

2014-03-11T05:42:28+00:00

Signed-off-by: Christian Riesch Cc: Artem Bityutskiy Signed-off-by: Brian Norris

mtd: mtdchar: return expected errors on mmap() call

2013-11-11T19:18:15+00:00

According both to POSIX.1-2008 and Linux Programmer's Manual mmap() syscall shouldn't return undocumented ENOSYS, this change replaces the errno with more appropriate ENODEV and EACCESS. Signed-off-by: Vladimir Zapolskiy Cc: David Woodhouse Signed-off-by: Brian Norris

mtd: Move major number definitions to major.h

2013-11-07T07:32:59+00:00

This patch moves the char and block major number definitions to major.h to be with the rest of the major numbers. While doing this, include major.h in the files that need it. Signed-off-by: Ezequiel Garcia Signed-off-by: Brian Norris

mtdchar: switch to fixed_size_llseek()

2013-06-29T08:57:27+00:00

Signed-off-by: Al Viro

Merge tag 'for-linus-20130509' of git://git.infradead.org/linux-mtd

2013-05-09T17:15:46+00:00

Pull MTD update from David Woodhouse: - Lots of cleanups from Artem, including deletion of some obsolete drivers - Support partitions larger than 4GiB in device tree - Support for new SPI chips * tag 'for-linus-20130509' of git://git.infradead.org/linux-mtd: (83 commits) mtd: omap2: Use module_platform_driver() mtd: bf5xx_nand: Use module_platform_driver() mtd: denali_dt: Remove redundant use of of_match_ptr mtd: denali_dt: Change return value to fix smatch warning mtd: denali_dt: Use module_platform_driver() mtd: denali_dt: Fix incorrect error check mtd: nand: subpage write support for hardware based ECC schemes mtd: omap2: use msecs_to_jiffies() mtd: nand_ids: use size macros mtd: nand_ids: improve LEGACY_ID_NAND macro a bit mtd: add 4 Toshiba nand chips for the full-id case mtd: add the support to parse out the full-id nand type mtd: add new fields to nand_flash_dev{} mtd: sh_flctl: Use of_match_ptr() macro mtd: gpio: Use of_match_ptr() macro mtd: gpio: Use devm_kzalloc() mtd: davinci_nand: Use of_match_ptr() mtd: dataflash: Use of_match_ptr() macro mtd: remove h720x flash support mtd: onenand: remove OneNAND simulator ...

mtdchar: remove no-longer-used vma helpers

2013-04-19T17:05:39+00:00

With the conversion to vm_iomap_memory(), these vma helpers are no longer used. Signed-off-by: Linus Torvalds