1 files changed, 24 insertions, 6 deletions

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 79e3689f1e16..0a4760174782 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -120,8 +120,25 @@ static int part_read_oob(struct mtd_info *mtd, loff_t from,
                 return -EINVAL;
         if (ops->datbuf && from + ops->len > mtd->size)
                 return -EINVAL;
-        res = part->master->read_oob(part->master, from + part->offset, ops);
 
+        /*
+         * If OOB is also requested, make sure that we do not read past the end
+         * of this partition.
+         */
+        if (ops->oobbuf) {
+                size_t len, pages;
+
+                if (ops->mode == MTD_OOB_AUTO)
+                        len = mtd->oobavail;
+                else
+                        len = mtd->oobsize;
+                pages = mtd_div_by_ws(mtd->size, mtd);
+                pages -= mtd_div_by_ws(from, mtd);
+                if (ops->ooboffs + ops->ooblen > pages * len)
+                        return -EINVAL;
+        }
+
+        res = part->master->read_oob(part->master, from + part->offset, ops);
         if (unlikely(res)) {
                 if (res == -EUCLEAN)
                         mtd->ecc_stats.corrected++;
@@ -384,6 +401,7 @@ static struct mtd_part *allocate_partition(struct mtd_info *master,
         slave->mtd.flags = master->flags & ~part->mask_flags;
         slave->mtd.size = part->size;
         slave->mtd.writesize = master->writesize;
+        slave->mtd.writebufsize = master->writebufsize;
         slave->mtd.oobsize = master->oobsize;
         slave->mtd.oobavail = master->oobavail;
         slave->mtd.subpage_sft = master->subpage_sft;
@@ -720,19 +738,19 @@ int parse_mtd_partitions(struct mtd_info *master, const char **types,
 }
 EXPORT_SYMBOL_GPL(parse_mtd_partitions);
 
-int mtd_is_master(struct mtd_info *mtd)
+int mtd_is_partition(struct mtd_info *mtd)
 {
         struct mtd_part *part;
-        int nopart = 0;
+        int ispart = 0;
 
         mutex_lock(&mtd_partitions_mutex);
         list_for_each_entry(part, &mtd_partitions, list)
                 if (&part->mtd == mtd) {
-                        nopart = 1;
+                        ispart = 1;
                         break;
                 }
         mutex_unlock(&mtd_partitions_mutex);
 
-        return nopart;
+        return ispart;
 }
-EXPORT_SYMBOL_GPL(mtd_is_master);
+EXPORT_SYMBOL_GPL(mtd_is_partition);