Michał Kępień a1eda864c0 mtdchar: prevent integer overflow in a safety check ... Commit 6420ac0af9 ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl") added a safety check to mtdchar_write_ioctl() which attempts to ensure that the write request sent by user space does not extend beyond the MTD device's size. However, that check contains an addition of two struct mtd_write_req fields, 'start' and 'len', both of which are u64 variables. The result of that addition can overflow, allowing the safety check to be bypassed. The arguably simplest fix - changing the data types of the relevant struct mtd_write_req fields - is not feasible as it would break user space. Fix by making mtdchar_write_ioctl() truncate the value provided by user space in the 'len' field of struct mtd_write_req, so that only the lower 32 bits of that field are used, preventing the overflow. While the 'ooblen' field of struct mtd_write_req is not currently used in any similarly flawed safety check, also truncate it to 32 bits, for consistency with the 'len' field and with other MTD routines handling OOB data. Update include/uapi/mtd/mtd-abi.h accordingly. Suggested-by: Richard Weinberger <richard@nod.at> Signed-off-by: Michał Kępień <kernel@kempniu.pl> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20220516070601.11428-2-kernel@kempniu.pl		2022-06-09 15:03:32 +02:00
..
accessibility	Revert "speakup: Generate speakupmap.h automatically"	2022-05-20 21:07:05 +02:00
acpi	More power management updates for 5.19-rc1	2022-05-30 11:37:26 -07:00
amba	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
android	fix for breakage in #work.fd this window	2022-06-05 17:14:03 -07:00
ata	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
atm
auxdisplay
base	firmware_loader: enable XZ by default if compressed support is enabled	2022-06-03 15:46:03 -07:00
bcma
block	xen: branch for v5.19-rc1b	2022-06-04 13:42:53 -07:00
bluetooth
bus	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
cdrom
char	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
clk	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
clocksource	Clockevent/clocksource updates:	2022-06-05 10:47:06 -07:00
comedi	drivers: comedi: replace ternary operator with min()	2022-05-19 18:54:45 +02:00
connector
counter
cpufreq	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
cpuidle	Merge branches 'pm-em' and 'pm-cpuidle'	2022-05-23 19:18:51 +02:00
crypto	virtio-crypto: enable retry for virtio-crypto-dev	2022-05-31 12:45:09 -04:00
cxl	cxl/port: Enable HDM Capability after validating DVSEC Ranges	2022-05-20 12:30:53 -07:00
dax
dca
devfreq	PM / devfreq: passive: Return non-error when not-supported event is required	2022-05-19 19:32:19 +02:00
dio	drivers: dio: add missing iounmap() in dio_init()	2022-05-19 18:56:51 +02:00
dma	dmaengine updates for v5.19-rc1	2022-05-29 11:38:27 -07:00
dma-buf	drm for 5.19-rc1	2022-05-25 16:18:27 -07:00
edac	- A gargen variety of fixes which don't fit any other tip bucket:	2022-05-23 19:32:59 -07:00
eisa
extcon
firewire	Merge branch 'for-linus' into for-next	2022-05-23 07:48:27 +02:00
firmware	Follow-up tweaks for the EFI changes in v5.19	2022-06-03 13:39:30 -07:00
fpga
fsi
gnss
gpio	hte: New subsystem for v5.19-rc1	2022-06-05 09:12:28 -07:00
gpu	Bitmap patches for 5.19-rc1	2022-06-04 14:04:27 -07:00
greybus
hid	USB / Thunderbolt changes for 5.19-rc1	2022-06-03 11:17:49 -07:00
hsi
hte	hte: Uninitialized variable in hte_ts_get()	2022-05-20 15:54:41 +02:00
hv	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
hwmon	hwmon: (aquacomputer_d5next) Fix an error handling path in aqc_probe()	2022-05-22 12:25:55 -07:00
hwspinlock
hwtracing
i2c	i2c: ismt: prevent memory corruption in ismt_access()	2022-06-02 08:40:56 -07:00
i3c	i3c: master: svc: fix returnvar.cocci warning	2022-05-17 22:34:42 +02:00
idle
iio	Bitmap patches for 5.19-rc1	2022-06-04 14:04:27 -07:00
infiniband	v5.19 pull request	2022-05-26 21:08:40 -07:00
input	xen: branch for v5.19-rc1b	2022-06-04 13:42:53 -07:00
interconnect	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
iommu	IOMMU Updates for Linux v5.19	2022-05-31 09:56:54 -07:00
ipack
irqchip	irq: mips: replace cpumask_weight with cpumask_empty where appropriate	2022-06-03 06:52:57 -07:00
isdn
leds	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
macintosh	macintosh: via-pmu and via-cuda need RTC_LIB	2022-05-22 15:58:30 +10:00
mailbox	mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n	2022-05-24 08:08:24 -05:00
mcb
md	for-5.19/drivers-2022-06-02	2022-06-03 10:25:56 -07:00
media	USB / Thunderbolt changes for 5.19-rc1	2022-06-03 11:17:49 -07:00
memory	More power management updates for 5.19-rc1	2022-05-30 11:37:26 -07:00
memstick
message
mfd	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
misc	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
mmc	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
most
mtd	mtdchar: prevent integer overflow in a safety check	2022-06-09 15:03:32 +02:00
mux
net	Bitmap patches for 5.19-rc1	2022-06-04 14:04:27 -07:00
nfc	NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx	2022-05-19 17:54:02 -07:00
ntb
nubus
nvdimm	cxl for 5.19	2022-05-27 21:24:19 -07:00
nvme	SCSI misc on 20220604	2022-06-05 09:25:12 -07:00
nvmem
of	drm for 5.19-rc1	2022-05-25 16:18:27 -07:00
opp	OPP updates for 5.19-rc1	2022-05-25 15:02:26 +02:00
parisc
parport
pci	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
pcmcia	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
peci
perf	arm64 updates for 5.19:	2022-05-23 21:06:11 -07:00
phy	phy-for-5.19	2022-05-19 16:56:17 +02:00
pinctrl	Pin control bulk changes for the v5.19 series:	2022-05-28 11:15:54 -07:00
platform	Cleanups and fixes	2022-05-30 11:01:50 -07:00
pnp
power	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
powercap	Merge branches 'pm-em' and 'pm-cpuidle'	2022-05-23 19:18:51 +02:00
pps
ps3
ptp	ptp: ptp_clockmatrix: fix is_single_shot	2022-05-25 21:51:32 -07:00
pwm	pwm: pwm-cros-ec: Add channel type support	2022-05-20 16:40:01 +02:00
rapidio
ras
regulator	Merge back reboot/poweroff notifiers rework for 5.19-rc1.	2022-05-25 14:38:29 +02:00
remoteproc
reset
rpmsg	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
rtc	ARM: multiplatform changes, part 2	2022-06-02 15:23:54 -07:00
s390	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
sbus
scsi	SCSI misc on 20220604	2022-06-05 09:25:12 -07:00
sh
siox
slimbus	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
soc	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
soundwire
spi	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
spmi
ssb
staging	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
target	blk-mq: remove the done argument to blk_execute_rq_nowait	2022-05-28 06:15:27 -06:00
tc
tee	Fix a compiler warning in OP-TEE driver	2022-05-30 14:44:27 +02:00
thermal	Additional thermal control update for 5.19-rc1	2022-05-30 11:34:13 -07:00
thunderbolt	USB / Thunderbolt changes for 5.19-rc1	2022-06-03 11:17:49 -07:00
tty	xen: branch for v5.19-rc1b	2022-06-04 13:42:53 -07:00
ufs	SCSI misc on 20220604	2022-06-05 09:25:12 -07:00
uio
usb	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
vdpa	Driver core changes for 5.19-rc1	2022-06-03 11:48:47 -07:00
vfio	VFIO updates for v5.19-rc1	2022-06-01 13:49:15 -07:00
vhost	vhost: rename vhost_work_dev_flush	2022-05-31 12:45:10 -04:00
video	parisc architecture fixes & updates for kernel v5.19-rc1	2022-06-04 13:50:23 -07:00
virt	Char / Misc / Other smaller driver subsystem updates for 5.19-rc1	2022-06-03 11:36:34 -07:00
virtio	virtio: Directly use ida_alloc()/free()	2022-05-31 12:45:10 -04:00
vlynq
vme
w1
watchdog	ARM: SoC changes, part 2	2022-06-02 15:27:44 -07:00
xen	xen: branch for v5.19-rc1b	2022-06-04 13:42:53 -07:00
zorro
Kconfig	SCSI misc on 20220604	2022-06-05 09:25:12 -07:00
Makefile	SCSI misc on 20220604	2022-06-05 09:25:12 -07:00