Richard Weinberger e4f6daac20 ubi: Fix out of bounds write in volume update code ...

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>

2016-03-05 21:56:23 +01:00

..

chips

mtd: cfi_cmdset_0001: fixing memory leak and handling failed kmalloc

2016-01-06 17:23:10 -08:00

devices

mtd: m25p80: replace leftover "nor-jedec" with "spi-nor" in comments

2015-11-19 16:46:49 -08:00

lpddr

mtd: lpddr: show parent device in sysfs

2015-10-13 09:21:17 -07:00

maps

Merge tag 'for-linus-20160112' of git://git.infradead.org/linux-mtd

2016-01-13 11:25:54 -08:00

nand

mtd: jz4780_nand: replace if/else blocks with switch/case

2016-01-08 09:49:03 -08:00

onenand

mtd: drop unnecessary partition parser data

2015-11-11 13:58:59 -08:00

spi-nor

mtd: spi-nor: wait until lock/unlock operations are ready

2016-01-06 17:18:34 -08:00

tests

mtd: tests: consolidate kmalloc/memset 0 call to kzalloc

2016-01-06 15:17:42 -08:00

ubi

ubi: Fix out of bounds write in volume update code

2016-03-05 21:56:23 +01:00

afs.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

ar7part.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

bcm47xxpart.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

bcm63xxpart.c

Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus

2016-01-24 12:50:56 -08:00

cmdlinepart.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

ftl.c

mtd: ftl: use swap() in copy_erase_unit()

2015-12-18 16:56:07 -08:00

inftlcore.c

mtd: nand: add a helper to detect the nand type

2013-10-27 16:27:06 -07:00

inftlmount.c

mtd: intflmount: fix off by one error in INFTL_dumpVUchains()

2014-11-05 13:19:21 -08:00

Kconfig

mtd: enable AFS selection for ARM64

2015-11-10 17:56:05 -08:00

Makefile

mtd: spi-nor: shorten Kconfig naming

2014-04-14 11:23:01 -07:00

mtd_blkdevs.c

mtd: blkdevs: fix potential deadlock + lockdep warnings

2015-10-30 17:24:43 -07:00

mtdblock_ro.c

mtd: Move major number definitions to major.h

2013-11-06 23:32:59 -08:00

mtdblock.c

mtd: mtdblock: remove the needless mtdblks_lock

2015-01-07 12:51:56 -08:00

mtdchar.c

mtd: provide proper 32/64-bit compat_ioctl() support for BLKPG

2015-09-29 13:37:04 -07:00

mtdconcat.c

Merge tag 'for-linus-20150216' of git://git.infradead.org/linux-mtd

2015-02-18 08:01:44 -08:00

mtdcore.c

mtd: merge MTD development from v4.4 into for-v4.5 development

2016-01-05 16:05:56 -08:00

mtdcore.h

mtd: partitions: support a cleanup callback for parsers

2015-12-09 14:57:44 -08:00

mtdoops.c

…

mtdpart.c

mtd: partitions: support a cleanup callback for parsers

2015-12-09 14:57:44 -08:00

mtdsuper.c

mtd: Move major number definitions to major.h

2013-11-06 23:32:59 -08:00

mtdswap.c

mtd: use __packed shorthand

2014-08-19 11:53:08 -07:00

nftlcore.c

mtd: nand: add a helper to detect the nand type

2013-10-27 16:27:06 -07:00

nftlmount.c

mtd: nftl: reorganize operations in condition check

2015-01-09 15:26:29 -08:00

ofpart.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

redboot.c

mtd: partitions: make parsers return 'const' partition arrays

2015-12-09 10:21:57 -08:00

rfd_ftl.c

mtd: remove some duplicative checks

2014-03-10 22:42:25 -07:00

sm_ftl.c

mtd: sm_ftl: fix wrong do_div() usage

2015-11-16 15:07:16 -08:00

sm_ftl.h

…

ssfdc.c

mtd: nand: add a helper to detect the nand type

2013-10-27 16:27:06 -07:00