aboutsummaryrefslogtreecommitdiff
path: root/drivers/mtd
diff options
context:
space:
mode:
authorRichard Genoud <richard.genoud@gmail.com>2012-09-12 14:26:26 +0200
committerDavid Woodhouse <David.Woodhouse@intel.com>2012-09-29 15:54:12 +0100
commitbb0a13a13411c4ce24c48c8ff3cdf7b48d237240 (patch)
tree595cbf4572ee949f58ccfc0337fb43f78101f49d /drivers/mtd
parent5bf3d66a933efb71fa6db08a5043a617b6eadb4a (diff)
mtd: nandsim: bugfix: fail if overridesize is too big
If override size is too big, the module was actually loaded instead of failing, because retval was not set. This lead to memory corruption with the use of the freed structs nandsim and nand_chip. Cc: stable@vger.kernel.org Signed-off-by: Richard Genoud <richard.genoud@gmail.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/nand/nandsim.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 21e64b5d352..a932c485eb0 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2317,6 +2317,7 @@ static int __init ns_init_module(void)
uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
if (new_size >> overridesize != nsmtd->erasesize) {
NS_ERR("overridesize is too big\n");
+ retval = -EINVAL;
goto err_exit;
}
/* N.B. This relies on nand_scan not doing anything with the size before we change it */