aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRichard Genoud <richard.genoud@gmail.com>2012-09-12 14:26:26 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-10-13 05:28:15 +0900
commit776a41b87e94f6942793c3268a49809a6691e4e2 (patch)
treefc032a677b3e26c8d4f2e0386f76657e18a7d190
parentb4f7f36c74e7d0885fca8fd18675a19b74a76b43 (diff)
mtd: nandsim: bugfix: fail if overridesize is too big
commit bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 upstream. If override size is too big, the module was actually loaded instead of failing, because retval was not set. This lead to memory corruption with the use of the freed structs nandsim and nand_chip. Signed-off-by: Richard Genoud <richard.genoud@gmail.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/mtd/nand/nandsim.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 63c8048d70b..1f2b8803cca 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2355,6 +2355,7 @@ static int __init ns_init_module(void)
uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
if (new_size >> overridesize != nsmtd->erasesize) {
NS_ERR("overridesize is too big\n");
+ retval = -EINVAL;
goto err_exit;
}
/* N.B. This relies on nand_scan not doing anything with the size before we change it */