Messages in this thread | | | From | "Stein, Alexander" <> | Subject | Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds | Date | Mon, 23 Jan 2023 15:02:45 +0000 |
| |
Hi Tudor,
Am Mittwoch, 16. März 2022, 08:47:40 CET schrieb Tudor.Ambarus@microchip.com: > On 3/16/22 09:39, Alexander Stein wrote: > > > [You don't often get email from alexander.stein@tq-group.com. Learn why > > this is important at http://aka.ms/LearnAboutSenderIdentification.]
> > EXTERNAL EMAIL: Do not click links or open attachments unless you know the > > content is safe
> > Hello, > > > hi, > > > > > > Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus: > > > >> When paring SFDP we may choose to mask out an erase type, passing > >> an erase size of zero to spi_nor_set_erase_type(). > >> Fix shift-out-of-bounds and just clear the erase params when > >> passing zero for erase size. > >> While here avoid a superfluous dereference and use 'size' directly. > >> > >> > >> > >> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 > >> shift exponent 4294967295 is too large for 32-bit type 'int' > >> > >> > >> > >> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI > >> NOR flash memories") Reported-by: Alexander Stein > >> <Alexander.Stein@tq-group.com> > >> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> > >> --- > >> > >> drivers/mtd/spi-nor/core.c | 9 +++++++-- > >> 1 file changed, 7 insertions(+), 2 deletions(-) > >> > >> > >> > >> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c > >> index 3d97c189c332..a1b5d5432f41 100644 > >> --- a/drivers/mtd/spi-nor/core.c > >> +++ b/drivers/mtd/spi-nor/core.c > >> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct > >> spi_nor_erase_type *erase, u32 size, erase->size = size; > >> > >> erase->opcode = opcode; > >> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. > >> */ > >> > >> - erase->size_shift = ffs(erase->size) - 1; > >> - erase->size_mask = (1 << erase->size_shift) - 1; > >> + if (size) { > >> + erase->size_shift = ffs(size) - 1; > >> + erase->size_mask = (1 << erase->size_shift) - 1; > >> + } else { > >> + erase->size_shift = 0; > >> + erase->size_mask = 0; > >> + } > >> > >> } > >> > >> > >> > >> /** > > > > > > What is the status of this patch? It is not applied up until now, no? Has > > it been superseeded? > > > > > I think it's marked with "changes requested". I'm going to send a v2.
Is there a v2 somewhere?
Best regards, Alexander
| |