linux-kernel - Re: [PATCH] ubi: ensure that VID header offset + VID header size <= alloc, size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 19 Nov 2022 22:17:07 +0100 (CET)
From:   Richard Weinberger <richard@....at>
To:     George Kennedy <george.kennedy@...cle.com>
Cc:     Miquel Raynal <miquel.raynal@...tlin.com>,
        Vignesh Raghavendra <vigneshr@...com>,
        eorge kennedy <eorge.kennedy@...cle.com>,
        linux-mtd <linux-mtd@...ts.infradead.org>,
        syzkaller@...glegroups.com,
        linux-kernel <linux-kernel@...r.kernel.org>,
        harshit m mogalapalli <harshit.m.mogalapalli@...cle.com>
Subject: Re: [PATCH] ubi: ensure that VID header offset + VID header size <=
 alloc, size

----- Ursprüngliche Mail -----
> Fixes: 801c135ce73d ("UBI: Unsorted Block Images")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: George Kennedy <george.kennedy@...cle.com>
> ---
>  drivers/mtd/ubi/build.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index a32050fecabf..53aa4de6b963 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -663,6 +663,12 @@ static int io_init(struct ubi_device *ubi, int
> max_beb_per1024)
>  	ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
>  	ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
>  
> +	if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
> +	    ubi->vid_hdr_alsize)) {
> +		ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
> +		return -EINVAL;
> +	}
> +

Thanks for fixing this, applied to the fixes branch.
That said, something broke whitespaces in your patch, I applied it manually.
Context lines before and after contain an extra space and caused both
git am and patch to give up.

Thanks,
//richard