UBI: check max_beb_per1024 value in ubi_attach_mtd_dev

max_beb_per1024 shouldn't be negative, and a 0 value will be treated as
the default value. For the upper bound, 768/1024 should be enough.

Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 8a4eb7c3e0f4..3700bf77b0b8 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -49,6 +49,9 @@
 /* Maximum number of comma-separated items in the 'mtd=' parameter */
 #define MTD_PARAM_MAX_COUNT 2
 
+/* Maximum value for the number of bad PEBs per 1024 PEBs */
+#define MAX_MTD_UBI_BEB_LIMIT 768
+
 #ifdef CONFIG_MTD_UBI_MODULE
 #define ubi_is_module() 1
 #else
@@ -852,6 +855,12 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
         struct ubi_device *ubi;
         int i, err, ref = 0;
 
+        if (max_beb_per1024 < 0 || max_beb_per1024 > MAX_MTD_UBI_BEB_LIMIT)
+                return -EINVAL;
+
+        if (!max_beb_per1024)
+                max_beb_per1024 = CONFIG_MTD_UBI_BEB_LIMIT;
+
         /*
          * Check if we already have the same MTD device attached.
          *