* Fix partition alignment check in mtdcore.c

* Fix a buffer overflow in the Atmel NAND driver
 -----BEGIN PGP SIGNATURE-----
 
 iQJABAABCAAqBQJZzoipIxxib3Jpcy5icmV6aWxsb25AZnJlZS1lbGVjdHJvbnMu
 Y29tAAoJEGXtNgF+CLcAoGAP/A1M1l8GtFBvgyOzk/Mhbo04DZTu4WSLNqXxge25
 01LmEa6mc59invZmhkSz+6pevYKj990ebeZEYazWrPO15GpCM23ztoJHRsLXeNic
 CMky0SuOaeGoAAUyIUnTbzep6DoAhkEw3fZlv8H5T5AUeZLn6x2JdiVmVD8WuP8x
 l6/P1a4tudVITjT4+255cla2cSKfSMH7w6j9ww+ltp5ipIKSpX0tR/k/MLljQFd4
 8IsK1Xsxk5dakcErKchhkphmuuGUOV+zCIfYcB1IkDDLxwDrYimCaBHHdE6v2a5l
 JL95DhcxG78K2BZa7KO2/SmYaEDJzq/t3CCtMVB4iMRsI7FSRJynPFmtQyaXo4ok
 bWViqrualgcZIrs1/1ZN/o4aLnRlGBihu/9CLe1POAuad2qdTD+DkcYWb8tc7p/Y
 EF4m9ajYk8/9eb8z7LLRfGIflAxraF0AmrUmLeOS4VBGaFIcCC5WGj9XMapkZC40
 Oau7EjiSaHRCUeTLSsvBgNIGjBoxImslUPDBsZx0SHhIQ2aq1Iyg+pgbBPRWKYCv
 S3ZxyudiXNgfHCglNwC1aimq2O3o/qwu52L+3krOZGMBO9witmf3GnbUWLoIZwRl
 jLb11mYMOa/RgZSLGuOFwtTQLV6WAze1Q9woqnR++BpYtawBcAVLHgauZYfsenRC
 cM4j
 =5JLe
 -----END PGP SIGNATURE-----

Merge tag 'mtd/fixes-for-4.14-rc3' of git://git.infradead.org/linux-mtd

Pull mtd fixes from Boris Brezillon:

 - Fix partition alignment check in mtdcore.c

 - Fix a buffer overflow in the Atmel NAND driver

* tag 'mtd/fixes-for-4.14-rc3' of git://git.infradead.org/linux-mtd:
  mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user
  mtd: Fix partition alignment check on multi-erasesize devices

drivers/mtd/mtdpart.c

@@ -581,6 +581,14 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
 		slave->mtd.erasesize = parent->erasesize;
 	}
 
+	/*
+	 * Slave erasesize might differ from the master one if the master
+	 * exposes several regions with different erasesize. Adjust
+	 * wr_alignment accordingly.
+	 */
+	if (!(slave->mtd.flags & MTD_NO_ERASE))
+		wr_alignment = slave->mtd.erasesize;
+
 	tmp = slave->offset;
 	remainder = do_div(tmp, wr_alignment);
 	if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {

drivers/mtd/nand/atmel/pmecc.c

@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
 	size += (req->ecc.strength + 1) * sizeof(u16);
 	/* Reserve space for mu, dmu and delta. */
 	size = ALIGN(size, sizeof(s32));
-	size += (req->ecc.strength + 1) * sizeof(s32);
+	size += (req->ecc.strength + 1) * sizeof(s32) * 3;
 
 	user = kzalloc(size, GFP_KERNEL);
 	if (!user)