kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/mtd
History
Dan Carpenter f37efdd97f mtdchar: fix integer overflow in read/write ioctls 
commit e4185bed73 upstream.

The "req.start" and "req.len" variables are u64 values that come from the
user at the start of the function.  We mask away the high 32 bits of
"req.len" so that's capped at U32_MAX but the "req.start" variable can go
up to U64_MAX which means that the addition can still integer overflow.

Use check_add_overflow() to fix this bug.

Fixes: 095bb6e44e ("mtdchar: add MEMREAD ioctl")
Fixes: 6420ac0af9 ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-12-07 06:12:37 +09:00
..
chips mtd: cfi_cmdset_0001: Byte swap OTP info 2023-11-28 17:07:14 +00:00
devices mtd: powernv: Add check devm_kasprintf() returned value 2024-10-17 15:20:49 +02:00
hyperbus mtd: hyperbus: hbmc-am654: fix an OF node reference leak 2025-02-21 13:49:19 +01:00
lpddr mtd: lpddr2_nvm: Fix possible null-ptr-deref 2022-12-31 13:32:12 +01:00
maps mtd: maps: physmap-core: fix flash size larger than 32-bit 2024-03-26 18:20:50 -04:00
nand mtd: rawnand: cadence: fix DMA device NULL pointer dereference 2025-12-07 06:12:37 +09:00
parsers mtd: partitions: redboot: Added conversion of operands to a larger type 2024-07-05 09:31:48 +02:00
spi-nor mtd: spi-nor: Fix spi_nor_try_unlock_all() 2025-08-28 16:26:07 +02:00
tests mtd: make mtd_test.c a separate module 2024-08-03 08:49:20 +02:00
ubi ubi: fastmap: Fix duplicate slab cache names while attaching 2024-12-14 19:54:08 +01:00
ftl.c mtd: fix possible integer overflow in erase_xfer() 2025-08-15 12:05:01 +02:00
inftlcore.c mtd: inftlcore: Add error check for inftl_read_oob() 2025-04-25 10:43:41 +02:00
inftlmount.c mtd: inftl: remove unnecessary oom message 2021-06-11 20:44:21 +02:00
Kconfig mtdblock: Add comment about UBI block devices 2021-08-06 22:05:13 +02:00
Makefile mtd: Support kmsg dumper based on pstore/blk 2020-05-31 19:49:01 -07:00
mtd_blkdevs.c mtd: Fix gluebi NULL pointer dereference caused by ftl notifier 2024-01-25 15:27:21 -08:00
mtdblock.c mtdblock: tolerate corrected bit-flips 2023-04-20 12:35:06 +02:00
mtdblock_ro.c mtdblock: Warn if added for a NAND device 2021-08-17 18:41:59 +02:00
mtdchar.c mtdchar: fix integer overflow in read/write ioctls 2025-12-07 06:12:37 +09:00
mtdconcat.c mtd: fix repeated word in comment 2022-09-20 10:40:30 +02:00
mtdcore.c mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() 2024-06-12 11:03:22 +02:00
mtdcore.h mtd: Provide fs_context-aware mount_mtd() replacement 2019-09-05 14:34:23 -04:00
mtdoops.c mtd: mtdoops: Add a timestamp to the mtdoops header. 2022-04-26 09:27:12 +02:00
mtdpart.c mtd: mtdpart: Don't create platform device that'll never probe 2023-03-10 09:33:38 +01:00
mtdpstore.c mtd: Replace kcalloc() with devm_kcalloc() 2025-04-25 10:43:38 +02:00
mtdsuper.c mm: don't include <linux/blkdev.h> in <linux/backing-dev.h> 2021-10-18 06:17:01 -06:00
mtdswap.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
nftlcore.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
nftlmount.c mtd: nftl: remove unnecessary oom message 2021-06-11 20:43:26 +02:00
rfd_ftl.c mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev 2021-08-23 10:01:06 +02:00
sm_ftl.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
sm_ftl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ssfdc.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00