diff options
| author | Richard Weinberger <richard@nod.at> | 2014-05-05 07:11:54 -0300 |
|---|---|---|
| committer | Artem Bityutskiy <artem.bityutskiy@linux.intel.com> | 2014-07-28 18:52:13 +0300 |
| commit | 4df38926f337ff4de49a8fb512aa4a55df0c502d (patch) | |
| tree | 9679247b25fbc93fe8a80bad8f3fa2561e21193f /drivers/mtd | |
| parent | 0a3d571bb8940a189322cc5f51466bdab044a48b (diff) | |
| download | op-kernel-dev-4df38926f337ff4de49a8fb512aa4a55df0c502d.zip op-kernel-dev-4df38926f337ff4de49a8fb512aa4a55df0c502d.tar.gz | |
UBI: block: Avoid disk size integer overflow
This patch fixes the issue that on very large UBI volumes
UBI block does not work correctly.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/ubi/block.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c index 043919a..33c6495 100644 --- a/drivers/mtd/ubi/block.c +++ b/drivers/mtd/ubi/block.c @@ -378,9 +378,11 @@ int ubiblock_create(struct ubi_volume_info *vi) { struct ubiblock *dev; struct gendisk *gd; - int disk_capacity = (vi->size * vi->usable_leb_size) >> 9; + u64 disk_capacity = ((u64)vi->size * vi->usable_leb_size) >> 9; int ret; + if ((sector_t)disk_capacity != disk_capacity) + return -EFBIG; /* Check that the volume isn't already handled */ mutex_lock(&devices_mutex); if (find_dev_nolock(vi->ubi_num, vi->vol_id)) { @@ -500,8 +502,13 @@ int ubiblock_remove(struct ubi_volume_info *vi) static int ubiblock_resize(struct ubi_volume_info *vi) { struct ubiblock *dev; - int disk_capacity = (vi->size * vi->usable_leb_size) >> 9; + u64 disk_capacity = ((u64)vi->size * vi->usable_leb_size) >> 9; + if ((sector_t)disk_capacity != disk_capacity) { + ubi_warn("%s: the volume is too big, cannot resize (%d LEBs)", + dev->gd->disk_name, vi->size); + return -EFBIG; + } /* * Need to lock the device list until we stop using the device, * otherwise the device struct might get released in |
