Re: [PATCH] ubi: ensure that VID header offset + VID header size <= alloc, size

From: Richard Weinberger
Date: Sat Nov 19 2022 - 16:17:20 EST


----- Ursprüngliche Mail -----
> Fixes: 801c135ce73d ("UBI: Unsorted Block Images")
> Reported-by: syzkaller <syzkaller@xxxxxxxxxxxxxxxx>
> Signed-off-by: George Kennedy <george.kennedy@xxxxxxxxxx>
> ---
> drivers/mtd/ubi/build.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index a32050fecabf..53aa4de6b963 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -663,6 +663,12 @@ static int io_init(struct ubi_device *ubi, int
> max_beb_per1024)
> ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
> ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
>
> + if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
> + ubi->vid_hdr_alsize)) {
> + ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
> + return -EINVAL;
> + }
> +

Thanks for fixing this, applied to the fixes branch.
That said, something broke whitespaces in your patch, I applied it manually.
Context lines before and after contain an extra space and caused both
git am and patch to give up.

Thanks,
//richard