linux/drivers/mtd
Richard Weinberger e4f6daac20 ubi: Fix out of bounds write in volume update code
ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
2016-03-05 21:56:23 +01:00
..
chips mtd: cfi_cmdset_0001: fixing memory leak and handling failed kmalloc 2016-01-06 17:23:10 -08:00
devices mtd: m25p80: replace leftover "nor-jedec" with "spi-nor" in comments 2015-11-19 16:46:49 -08:00
lpddr mtd: lpddr: show parent device in sysfs 2015-10-13 09:21:17 -07:00
maps MTD updates for v4.5: 2016-01-13 11:25:54 -08:00
nand mtd: jz4780_nand: replace if/else blocks with switch/case 2016-01-08 09:49:03 -08:00
onenand mtd: drop unnecessary partition parser data 2015-11-11 13:58:59 -08:00
spi-nor mtd: spi-nor: wait until lock/unlock operations are ready 2016-01-06 17:18:34 -08:00
tests mtd: tests: consolidate kmalloc/memset 0 call to kzalloc 2016-01-06 15:17:42 -08:00
ubi ubi: Fix out of bounds write in volume update code 2016-03-05 21:56:23 +01:00
afs.c mtd: partitions: make parsers return 'const' partition arrays 2015-12-09 10:21:57 -08:00
ar7part.c mtd: partitions: make parsers return 'const' partition arrays 2015-12-09 10:21:57 -08:00
bcm47xxpart.c mtd: partitions: make parsers return 'const' partition arrays 2015-12-09 10:21:57 -08:00
bcm63xxpart.c Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2016-01-24 12:50:56 -08:00
cmdlinepart.c mtd: partitions: make parsers return 'const' partition arrays 2015-12-09 10:21:57 -08:00
ftl.c mtd: ftl: use swap() in copy_erase_unit() 2015-12-18 16:56:07 -08:00
inftlcore.c
inftlmount.c mtd: intflmount: fix off by one error in INFTL_dumpVUchains() 2014-11-05 13:19:21 -08:00
Kconfig mtd: enable AFS selection for ARM64 2015-11-10 17:56:05 -08:00
Makefile mtd: spi-nor: shorten Kconfig naming 2014-04-14 11:23:01 -07:00
mtd_blkdevs.c mtd: blkdevs: fix potential deadlock + lockdep warnings 2015-10-30 17:24:43 -07:00
mtdblock_ro.c mtd: Move major number definitions to major.h 2013-11-06 23:32:59 -08:00
mtdblock.c mtd: mtdblock: remove the needless mtdblks_lock 2015-01-07 12:51:56 -08:00
mtdchar.c mtd: provide proper 32/64-bit compat_ioctl() support for BLKPG 2015-09-29 13:37:04 -07:00
mtdconcat.c MTD updates for 3.20-rc1 2015-02-18 08:01:44 -08:00
mtdcore.c mtd: merge MTD development from v4.4 into for-v4.5 development 2016-01-05 16:05:56 -08:00
mtdcore.h mtd: partitions: support a cleanup callback for parsers 2015-12-09 14:57:44 -08:00
mtdoops.c
mtdpart.c mtd: partitions: support a cleanup callback for parsers 2015-12-09 14:57:44 -08:00
mtdsuper.c mtd: Move major number definitions to major.h 2013-11-06 23:32:59 -08:00
mtdswap.c mtd: use __packed shorthand 2014-08-19 11:53:08 -07:00
nftlcore.c
nftlmount.c mtd: nftl: reorganize operations in condition check 2015-01-09 15:26:29 -08:00
ofpart.c mtd: partitions: make parsers return 'const' partition arrays 2015-12-09 10:21:57 -08:00
redboot.c mtd: partitions: make parsers return 'const' partition arrays 2015-12-09 10:21:57 -08:00
rfd_ftl.c mtd: remove some duplicative checks 2014-03-10 22:42:25 -07:00
sm_ftl.c mtd: sm_ftl: fix wrong do_div() usage 2015-11-16 15:07:16 -08:00
sm_ftl.h
ssfdc.c