Commit a6ea4407 authored by Artem Bityutskiy's avatar Artem Bityutskiy
Browse files

UBI: improve mkvol request validation 



Check that volume name is not shorter than 'name_len'.

No need to copy the trailing zero byte because whole array
was zeroed earlier.

Signed-off-by: default avatarArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
parent a5bf6190

drivers/mtd/ubi/cdev.c

+5 −2
Original line number Diff line number Diff line
@@ -574,6 +574,10 @@ static int verify_mkvol_req(const struct ubi_device *ubi, 
		goto bad;

	}



	n = strnlen(req->name, req->name_len + 1);

	if (n != req->name_len)

		goto bad;



	return 0;



bad:
@@ -629,12 +633,11 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, 
			break;

		}



		req.name[req.name_len] = '\0';

		err = verify_mkvol_req(ubi, &req);

		if (err)

			break;



		req.name[req.name_len] = '\0';



		mutex_lock(&ubi->volumes_mutex);

		err = ubi_create_volume(ubi, &req);

		mutex_unlock(&ubi->volumes_mutex);

drivers/mtd/ubi/vmt.c

+2 −2
Original line number Diff line number Diff line
@@ -275,7 +275,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) 
	vol->data_pad  = ubi->leb_size % vol->alignment;

	vol->vol_type  = req->vol_type;

	vol->name_len  = req->name_len;

	memcpy(vol->name, req->name, vol->name_len + 1);

	memcpy(vol->name, req->name, vol->name_len);

	vol->ubi = ubi;



	/*
@@ -350,7 +350,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) 
		vtbl_rec.vol_type = UBI_VID_DYNAMIC;

	else

		vtbl_rec.vol_type = UBI_VID_STATIC;

	memcpy(vtbl_rec.name, vol->name, vol->name_len + 1);

	memcpy(vtbl_rec.name, vol->name, vol->name_len);



	err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);

	if (err)