From: "Florian Otte" <fotte@uni-osnabrueck.de>
To: barebox@lists.infradead.org
Subject: Bufferoverflow on eMMC partition handling
Date: Mon, 02 Sep 2024 11:37:56 +0200 [thread overview]
Message-ID: <9f97-66d58780-19-542e2c00@140924414> (raw)
[-- Attachment #1: Type: text/plain, Size: 492 bytes --]
Hi Everyone.
I tried to use all general purpose partitions on an eMMC storage device and ran into some trouble. In ./include/mci.h the number of partitions is limited to 6, but there might be 7 partitions. This results in a buffer overflow or access out of bound and causes a nasty bootloop when all general purpose-partitions are used. I created a simple patch and appended it to this mail.
Kind regards
fotte
[Edit]: Sorry. Clicked the wrong button to fast. Now with Attachment.
[-- Attachment #2: 0001-FIX-buffer-overflow-on-MCI-partition-enumeration.patch --]
[-- Type: text/plain, Size: 1082 bytes --]
>From 0bae0df23bbc4a9e98f1bcac6c6fbe0c3b21bc78 Mon Sep 17 00:00:00 2001
From: Florian Otte <fotte@uos.de>
Date: Mon, 2 Sep 2024 11:27:47 +0200
Subject: [PATCH] FIX: buffer overflow on MCI-partition enumeration
Memory for up to 6 partitions is reserved, however there can be up to 7
partitions on an mci storage (e.g. emmc). A user partition two boot partitions
and up to four general pupose partitions.
---
include/mci.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/mci.h b/include/mci.h
index 3bf1455a40..cd01e2f992 100644
--- a/include/mci.h
+++ b/include/mci.h
@@ -600,7 +600,10 @@ struct mci_host {
#define MMC_NUM_BOOT_PARTITION 2
#define MMC_NUM_GP_PARTITION 4
-#define MMC_NUM_PHY_PARTITION 6
+#define MMC_NUM_USER_PARTITION 1
+#define MMC_NUM_PHY_PARTITION (MMC_NUM_BOOT_PARTITION + \
+ MMC_NUM_GP_PARTITION + \
+ MMC_NUM_USER_PARTITION)
struct mci_part {
struct block_device blk; /**< the blockdevice for the card */
--
2.39.2
next reply other threads:[~2024-09-02 9:38 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-02 9:37 Florian Otte [this message]
2024-09-03 11:35 ` Sascha Hauer
2024-09-03 11:38 ` Sascha Hauer
[not found] ` <8f55-66daa100-d-4fcf7800@71062216>
2024-09-06 10:43 ` Sascha Hauer
2024-09-11 8:28 ` Sascha Hauer
-- strict thread matches above, loose matches on Subject: below --
2024-09-02 9:36 Florian Otte
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9f97-66d58780-19-542e2c00@140924414 \
--to=fotte@uni-osnabrueck.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox