Messages in this thread Patch in this message | | | From | Tudor Ambarus <> | Subject | [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds | Date | Sat, 6 Nov 2021 09:56:15 +0200 |
| |
When paring SFDP we may choose to mask out an erase type, passing an erase size of zero to spi_nor_set_erase_type(). Fix shift-out-of-bounds and just clear the erase params when passing zero for erase size. While here avoid a superfluous dereference and use 'size' directly.
UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int'
Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Reported-by: Alexander Stein <Alexander.Stein@tq-group.com> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> --- drivers/mtd/spi-nor/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index 3d97c189c332..a1b5d5432f41 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, erase->size = size; erase->opcode = opcode; /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ - erase->size_shift = ffs(erase->size) - 1; - erase->size_mask = (1 << erase->size_shift) - 1; + if (size) { + erase->size_shift = ffs(size) - 1; + erase->size_mask = (1 << erase->size_shift) - 1; + } else { + erase->size_shift = 0; + erase->size_mask = 0; + } } /** -- 2.25.1
| |