diff options
| author | Will Newton <will.newton@gmail.com> | 2012-03-30 11:51:02 +0100 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2012-05-07 20:29:50 +0100 |
| commit | 7a84477c4acebf6299b6a8bd6a1d5894eb838ffa (patch) | |
| tree | 7ead0857a87874bb3362953d5fb55749f88903de /fs/libfs.c | |
| parent | 66f75a5d028beaf67c931435fdc3e7823125730c (diff) | |
| download | linux-3.10-7a84477c4acebf6299b6a8bd6a1d5894eb838ffa.tar.gz linux-3.10-7a84477c4acebf6299b6a8bd6a1d5894eb838ffa.tar.bz2 linux-3.10-7a84477c4acebf6299b6a8bd6a1d5894eb838ffa.zip | |
mtd: fix oops in dataflash driver
I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
with -1 for offset and length and a NULL buffer to test if OTP
operations are supported. This finds its way down to otp_read in
mtd_dataflash.c and causes an oops when memcpying the returned data
into the NULL buf.
None of the checks in otp_read catches the negative length and offset.
Changing the length of the dummy read to 0 prevents the oops.
Cc: stable@kernel.org [3.3+]
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'fs/libfs.c')
0 files changed, 0 insertions, 0 deletions