Richard Weinberger e4f6daac20 ubi: Fix out of bounds write in volume update code ...

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>

2016-03-05 21:56:23 +01:00

..

attach.c

UBI: drop null test before destroy functions

2015-10-03 20:36:10 +02:00

block.c

Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2015-07-01 10:49:25 -07:00

build.c

UBI: Use static class and attribute groups

2015-06-02 13:16:25 +02:00

cdev.c

wrappers for ->i_mutex access

2016-01-22 18:04:28 -05:00

debug.c

UBI: fix return error code

2015-12-16 22:45:04 +01:00

debug.h

UBI: power cut emulation for testing

2015-04-13 21:05:17 +02:00

eba.c

UBI: Fix debug message

2015-10-03 20:09:55 +02:00

fastmap-wl.c

ubi: fastmap: Implement produce_free_peb()

2015-10-03 23:25:30 +02:00

fastmap.c

UBI: Fastmap: Fix PEB array type

2015-11-06 23:26:50 +01:00

gluebi.c

UBI: Update comments to reflect UBI_METAONLY flag

2015-10-03 20:11:59 +02:00

io.c

UBI: fix use of "VID" vs. "EC" in header self-check

2015-12-16 22:46:26 +01:00

kapi.c

VFS: assorted d_backing_inode() annotations

2015-04-15 15:06:59 -04:00

Kconfig

UBI: block: Add CONFIG_BLOCK dependency

2014-03-04 14:49:53 +02:00

Makefile

UBI: R/O block driver on top of UBI volumes

2014-02-28 16:29:48 +02:00

misc.c

UBI: fix soft lockup in ubi_check_volume()

2015-01-28 16:18:09 +01:00

ubi-media.h

UBI: Fix typo in comment

2015-10-03 20:09:41 +02:00

ubi.h

UBI: Use static class and attribute groups

2015-06-02 13:16:25 +02:00

upd.c

ubi: Fix out of bounds write in volume update code

2016-03-05 21:56:23 +01:00

vmt.c

UBI: Use static class and attribute groups

2015-06-02 13:16:25 +02:00

vtbl.c

UBI: return ENOSPC if no enough space available

2015-09-29 12:47:05 +02:00

wl.c

mtd: ubi: wl: avoid erasing a PEB which is empty

2016-01-10 12:33:11 +01:00

wl.h

UBI: Fastmap: Remove is_fm_block()

2015-03-26 22:47:38 +01:00