aboutsummaryrefslogtreecommitdiffstats
path: root/target
diff options
context:
space:
mode:
authorOldřich Jedlička <oldium.pro@gmail.com>2019-09-25 21:45:42 +0200
committerPetr Štetiar <ynezz@true.cz>2019-10-09 14:45:25 +0200
commite0ce80d42ace6feba509da16795ab0eb81cf5bf4 (patch)
tree480373e870852be3f9af5e743005ed39d972fa96 /target
parent4ed356fa719e8923c231524181e15ab67eb37bac (diff)
downloadupstream-e0ce80d42ace6feba509da16795ab0eb81cf5bf4.tar.gz
upstream-e0ce80d42ace6feba509da16795ab0eb81cf5bf4.tar.bz2
upstream-e0ce80d42ace6feba509da16795ab0eb81cf5bf4.zip
kernel: Fix off-by-one error in FIT mtd partition search.
This fixes off-by-one error introduced in commit dc76900021b8 ("kernel: Correctly search for the FIT image in mtd partition.") Function `mtd_read` starts reading at `offset` and needs `hdr_len` number of bytes to be available. Suppose the easiest case when `offset` is `0` and `hdr_len` equals to `mtd->size` - the `for` loop will not be entered even when enough bytes are available to be read. Same happens for any non-zero `offset`, when `hdr_len` is just enough bytes to be read until `mtd->size` is reached. Imagine that for example `mtd->size=5`, `offset=4` and `hdr_len=1`. Then `offset+hdr_len=5` and the check has to be `offset+hdr_len <= mtd->size`, i.e. `5 <= 5`. The check for `offset + hdr_len` value needs to be inclusive, therefore use `<=`. Fixes: dc76900021b8 ("kernel: Correctly search for the FIT image in mtd partition.") Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com> [adjusted commit ref, fixes tag] Signed-off-by: Petr Štetiar <ynezz@true.cz>
Diffstat (limited to 'target')
-rw-r--r--target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
index d206fecd5b..67ee33d085 100644
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
@@ -60,7 +60,7 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
hdr_len = sizeof(struct fdt_header);
/* Parse the MTD device & search for the FIT image location */
- for(offset = 0; offset + hdr_len < mtd->size; offset += mtd->erasesize) {
+ for(offset = 0; offset + hdr_len <= mtd->size; offset += mtd->erasesize) {
ret = mtd_read(mtd, offset, hdr_len, &retlen, (void*) &hdr);
if (ret) {
pr_err("read error in \"%s\" at offset 0x%llx\n",