1 files changed, 18 insertions, 1 deletions

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index b910a37baed8..0a4760174782 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -120,8 +120,25 @@ static int part_read_oob(struct mtd_info *mtd, loff_t from,
                 return -EINVAL;
         if (ops->datbuf && from + ops->len > mtd->size)
                 return -EINVAL;
-        res = part->master->read_oob(part->master, from + part->offset, ops);
 
+        /*
+         * If OOB is also requested, make sure that we do not read past the end
+         * of this partition.
+         */
+        if (ops->oobbuf) {
+                size_t len, pages;
+
+                if (ops->mode == MTD_OOB_AUTO)
+                        len = mtd->oobavail;
+                else
+                        len = mtd->oobsize;
+                pages = mtd_div_by_ws(mtd->size, mtd);
+                pages -= mtd_div_by_ws(from, mtd);
+                if (ops->ooboffs + ops->ooblen > pages * len)
+                        return -EINVAL;
+        }
+
+        res = part->master->read_oob(part->master, from + part->offset, ops);
         if (unlikely(res)) {
                 if (res == -EUCLEAN)
                         mtd->ecc_stats.corrected++;