Messages in this thread | | | From | "Stein, Alexander" <> | Subject | Re: (EXT) [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds | Date | Mon, 8 Nov 2021 09:26:49 +0000 |
| |
Am Samstag, dem 06.11.2021 um 09:56 +0200 schrieb Tudor Ambarus: > When paring SFDP we may choose to mask out an erase type, passing > an erase size of zero to spi_nor_set_erase_type(). > Fix shift-out-of-bounds and just clear the erase params when > passing zero for erase size. > While here avoid a superfluous dereference and use 'size' directly. > > UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 > shift exponent 4294967295 is too large for 32-bit type 'int' > > Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP > SPI NOR flash memories") > Reported-by: Alexander Stein < > Alexander.Stein@tq-group.com > > > Signed-off-by: Tudor Ambarus < > tudor.ambarus@microchip.com > > > --- > drivers/mtd/spi-nor/core.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c > index 3d97c189c332..a1b5d5432f41 100644 > --- a/drivers/mtd/spi-nor/core.c > +++ b/drivers/mtd/spi-nor/core.c > @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct > spi_nor_erase_type *erase, u32 size, > erase->size = size; > erase->opcode = opcode; > /* JEDEC JESD216B Standard imposes erase sizes to be power of > 2. */ > - erase->size_shift = ffs(erase->size) - 1; > - erase->size_mask = (1 << erase->size_shift) - 1; > + if (size) { > + erase->size_shift = ffs(size) - 1; > + erase->size_mask = (1 << erase->size_shift) - 1; > + } else { > + erase->size_shift = 0; > + erase->size_mask = 0; > + } > } > > /**
Tested-By: Alexander Stein <Alexander.Stein@tq-group.com>
It fixes the UBSAN error and my spi-nor flash can still be detected.
Best regards, Alexander
| |