From nobody Sun Feb 8 12:32:52 2026 Received: from mx.swemel.ru (mx.swemel.ru [95.143.211.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2D671CB528; Tue, 26 Nov 2024 12:54:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.143.211.150 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732625703; cv=none; b=cGhdF97Hp1A9DlRTvj6a7clViKIJibqQL4xE/w7Rs/9XIlb+PaWMlUe0YqkCY+ZpkTwXFLgJg16HTb4zrotciaJvcy94rwk/0hK9NP2HvEKYPZvl1hOdvEsnEu9LSOdpL/fWvBLpvTlmPeTWQs+GNKPRZEzKD7LSbJlYQTuq9t4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732625703; c=relaxed/simple; bh=lOayRBayZGSlXgUrI9KvTQ7rdb+QafjbTeNRnQUzG6M=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=RMT7dVvvHosdThAM+4WEXF2R9VHQd+UgMSqZUvGIbYmLdQ+Ojz1hKEvHPY2hjrzawkuXbSehJR8a/ulqoTbBJmXQiMTFT3d5R0CXTRPkKSOFqo+gEaIfP4cLF+CshvQo9MQH9Hf1QoTdX/lBK398qzH1b0PFx9flm5F9QuBtSu4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=swemel.ru; spf=pass smtp.mailfrom=swemel.ru; dkim=pass (1024-bit key) header.d=swemel.ru header.i=@swemel.ru header.b=gCJePDl8; arc=none smtp.client-ip=95.143.211.150 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=swemel.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=swemel.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=swemel.ru header.i=@swemel.ru header.b="gCJePDl8" From: Denis Arefev DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=swemel.ru; s=mail; t=1732625693; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=vsUdwmzHEUtFp4dw0uNgWDj5eMaa/8lI8CftTMle4BI=; b=gCJePDl8k8J6FYa4kh0bfJNI92W3gKJuaYiRGN8YtarRJ9aQXApNOH85N3jH3E7lY7LlSo /qeTPTA2VsBzBjrxWHnrs49EguBWr5N4w04PBpPDNuru6gfYEdh8skXSYQtmylJM3LdEjh DOE6NrPWGxYKZ4Lw6s+DwtQ5gFgWAyE= To: Richard Weinberger Cc: Zhihao Cheng , Miquel Raynal , Vignesh Raghavendra , Artem Bityutskiy , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2] mtd: ubi: Added a check for ubi_num Date: Tue, 26 Nov 2024 15:54:53 +0300 Message-Id: <20241126125453.6610-1-arefev@swemel.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Added a check for ubi_num for negative numbers If the variable ubi_num takes negative values then we get: qemu-system-arm ... -append "ubi.mtd=3D0,0,0,-22222345" ... [ 0.745065] ubi_attach_mtd_dev from ubi_init+0x178/0x218 [ 0.745230] ubi_init from do_one_initcall+0x70/0x1ac [ 0.745344] do_one_initcall from kernel_init_freeable+0x198/0x224 [ 0.745474] kernel_init_freeable from kernel_init+0x18/0x134 [ 0.745600] kernel_init from ret_from_fork+0x14/0x28 [ 0.745727] Exception stack(0x90015fb0 to 0x90015ff8) Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 83ff59a06663 ("UBI: support ubi_num on mtd.ubi command line") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Reviewed-by: Zhihao Cheng --- V1 -> V2: changed the tag Fixes and moved the check to ubi_mtd_param_parse() drivers/mtd/ubi/build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 30be4ed68fad..ef6a22f372f9 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -1537,7 +1537,7 @@ static int ubi_mtd_param_parse(const char *val, const= struct kernel_param *kp) if (token) { int err =3D kstrtoint(token, 10, &p->ubi_num); =20 - if (err) { + if (err || p->ubi_num < UBI_DEV_NUM_AUTO) { pr_err("UBI error: bad value for ubi_num parameter: %s\n", token); return -EINVAL; --=20 2.25.1