Commit c10fbc83 authored by Denis Arefev's avatar Denis Arefev Committed by Wang Zhaolong
Browse files

ubi: Add a check for ubi_num 

mainline inclusion
from mainline-v6.14-rc1
commit 97bbf9e312c3fbaf0baa56120238825d2eb23b8a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBP1QB
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=97bbf9e312c3fbaf0baa56120238825d2eb23b8a



--------------------------------

Added a check for ubi_num for negative numbers
If the variable ubi_num takes negative values then we get:

qemu-system-arm ... -append "ubi.mtd=0,0,0,-22222345" ...
[    0.745065]  ubi_attach_mtd_dev from ubi_init+0x178/0x218
[    0.745230]  ubi_init from do_one_initcall+0x70/0x1ac
[    0.745344]  do_one_initcall from kernel_init_freeable+0x198/0x224
[    0.745474]  kernel_init_freeable from kernel_init+0x18/0x134
[    0.745600]  kernel_init from ret_from_fork+0x14/0x28
[    0.745727] Exception stack(0x90015fb0 to 0x90015ff8)

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 83ff59a0 ("UBI: support ubi_num on mtd.ubi command line")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDenis Arefev <arefev@swemel.ru>
Reviewed-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarWang Zhaolong <wangzhaolong1@huawei.com>
parent 64193129

drivers/mtd/ubi/build.c

+1 −1
Original line number Diff line number Diff line
@@ -1470,7 +1470,7 @@ static int ubi_mtd_param_parse(const char *val, const struct kernel_param *kp) 
	if (token) {

		int err = kstrtoint(token, 10, &p->ubi_num);



		if (err) {

		if (err || p->ubi_num < UBI_DEV_NUM_AUTO) {

			pr_err("UBI error: bad value for ubi_num parameter: %s\n",

			       token);

			return -EINVAL;