| Message ID | 20211106075616.95401-2-tudor.ambarus@microchip.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Ambarus Tudor |
| Headers | show |
| Series | [1/2] mtd: spi-nor: Fix shift-out-of-bounds | expand |
Am Samstag, dem 06.11.2021 um 09:56 +0200 schrieb Tudor Ambarus: > When paring SFDP we may choose to mask out an erase type, passing > an erase size of zero to spi_nor_set_erase_type(). > Fix shift-out-of-bounds and just clear the erase params when > passing zero for erase size. > While here avoid a superfluous dereference and use 'size' directly. > > UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 > shift exponent 4294967295 is too large for 32-bit type 'int' > > Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP > SPI NOR flash memories") > Reported-by: Alexander Stein < > Alexander.Stein@tq-group.com > > > Signed-off-by: Tudor Ambarus < > tudor.ambarus@microchip.com > > > --- > drivers/mtd/spi-nor/core.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c > index 3d97c189c332..a1b5d5432f41 100644 > --- a/drivers/mtd/spi-nor/core.c > +++ b/drivers/mtd/spi-nor/core.c > @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct > spi_nor_erase_type *erase, u32 size, > erase->size = size; > erase->opcode = opcode; > /* JEDEC JESD216B Standard imposes erase sizes to be power of > 2. */ > - erase->size_shift = ffs(erase->size) - 1; > - erase->size_mask = (1 << erase->size_shift) - 1; > + if (size) { > + erase->size_shift = ffs(size) - 1; > + erase->size_mask = (1 << erase->size_shift) - 1; > + } else { > + erase->size_shift = 0; > + erase->size_mask = 0; > + } > } > > /** Tested-By: Alexander Stein <Alexander.Stein@tq-group.com> It fixes the UBSAN error and my spi-nor flash can still be detected. Best regards, Alexander
On 06/11/21 09:56AM, Tudor Ambarus wrote: > When paring SFDP we may choose to mask out an erase type, passing > an erase size of zero to spi_nor_set_erase_type(). > Fix shift-out-of-bounds and just clear the erase params when > passing zero for erase size. > While here avoid a superfluous dereference and use 'size' directly. > > UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 > shift exponent 4294967295 is too large for 32-bit type 'int' > > Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") > Reported-by: Alexander Stein <Alexander.Stein@tq-group.com> > Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> > --- > drivers/mtd/spi-nor/core.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c > index 3d97c189c332..a1b5d5432f41 100644 > --- a/drivers/mtd/spi-nor/core.c > +++ b/drivers/mtd/spi-nor/core.c > @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, > erase->size = size; > erase->opcode = opcode; > /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ The change itself looks fine to me. So, Reviewed-by: Pratyush Yadav <p.yadav@ti.com> But I wonder if this code is doing the right thing. If a flash is setting an incorrect erase size, shouldn't we fail loudly to make sure the error is corrected, instead of working around it silently? If you don't want to return an error here, how about: WARN_ON(ffs(size) != fls(size)) or even a dev_warn() print so the programmer is aware of this. > - erase->size_shift = ffs(erase->size) - 1; > - erase->size_mask = (1 << erase->size_shift) - 1; > + if (size) { > + erase->size_shift = ffs(size) - 1; > + erase->size_mask = (1 << erase->size_shift) - 1; > + } else { > + erase->size_shift = 0; > + erase->size_mask = 0; > + } > } > > /** > -- > 2.25.1 >
Hello, Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus: > When paring SFDP we may choose to mask out an erase type, passing > an erase size of zero to spi_nor_set_erase_type(). > Fix shift-out-of-bounds and just clear the erase params when > passing zero for erase size. > While here avoid a superfluous dereference and use 'size' directly. > > UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 > shift exponent 4294967295 is too large for 32-bit type 'int' > > Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR > flash memories") Reported-by: Alexander Stein > <Alexander.Stein@tq-group.com> > Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> > --- > drivers/mtd/spi-nor/core.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c > index 3d97c189c332..a1b5d5432f41 100644 > --- a/drivers/mtd/spi-nor/core.c > +++ b/drivers/mtd/spi-nor/core.c > @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type > *erase, u32 size, erase->size = size; > erase->opcode = opcode; > /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ > - erase->size_shift = ffs(erase->size) - 1; > - erase->size_mask = (1 << erase->size_shift) - 1; > + if (size) { > + erase->size_shift = ffs(size) - 1; > + erase->size_mask = (1 << erase->size_shift) - 1; > + } else { > + erase->size_shift = 0; > + erase->size_mask = 0; > + } > } > > /** What is the status of this patch? It is not applied up until now, no? Has it been superseeded? Regards, Alexander
On 3/16/22 09:39, Alexander Stein wrote: > [You don't often get email from alexander.stein@tq-group.com. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] > > EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe > > Hello, hi, > > Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus: >> When paring SFDP we may choose to mask out an erase type, passing >> an erase size of zero to spi_nor_set_erase_type(). >> Fix shift-out-of-bounds and just clear the erase params when >> passing zero for erase size. >> While here avoid a superfluous dereference and use 'size' directly. >> >> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 >> shift exponent 4294967295 is too large for 32-bit type 'int' >> >> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR >> flash memories") Reported-by: Alexander Stein >> <Alexander.Stein@tq-group.com> >> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> >> --- >> drivers/mtd/spi-nor/core.c | 9 +++++++-- >> 1 file changed, 7 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c >> index 3d97c189c332..a1b5d5432f41 100644 >> --- a/drivers/mtd/spi-nor/core.c >> +++ b/drivers/mtd/spi-nor/core.c >> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type >> *erase, u32 size, erase->size = size; >> erase->opcode = opcode; >> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ >> - erase->size_shift = ffs(erase->size) - 1; >> - erase->size_mask = (1 << erase->size_shift) - 1; >> + if (size) { >> + erase->size_shift = ffs(size) - 1; >> + erase->size_mask = (1 << erase->size_shift) - 1; >> + } else { >> + erase->size_shift = 0; >> + erase->size_mask = 0; >> + } >> } >> >> /** > > What is the status of this patch? It is not applied up until now, no? Has it > been superseeded? > I think it's marked with "changes requested". I'm going to send a v2.
Hi Tudor, Am Mittwoch, 16. März 2022, 08:47:40 CET schrieb Tudor.Ambarus@microchip.com: > On 3/16/22 09:39, Alexander Stein wrote: > > > [You don't often get email from alexander.stein@tq-group.com. Learn why > > this is important at http://aka.ms/LearnAboutSenderIdentification.] > > EXTERNAL EMAIL: Do not click links or open attachments unless you know the > > content is safe > > Hello, > > > hi, > > > > > > Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus: > > > >> When paring SFDP we may choose to mask out an erase type, passing > >> an erase size of zero to spi_nor_set_erase_type(). > >> Fix shift-out-of-bounds and just clear the erase params when > >> passing zero for erase size. > >> While here avoid a superfluous dereference and use 'size' directly. > >> > >> > >> > >> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 > >> shift exponent 4294967295 is too large for 32-bit type 'int' > >> > >> > >> > >> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI > >> NOR flash memories") Reported-by: Alexander Stein > >> <Alexander.Stein@tq-group.com> > >> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> > >> --- > >> > >> drivers/mtd/spi-nor/core.c | 9 +++++++-- > >> 1 file changed, 7 insertions(+), 2 deletions(-) > >> > >> > >> > >> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c > >> index 3d97c189c332..a1b5d5432f41 100644 > >> --- a/drivers/mtd/spi-nor/core.c > >> +++ b/drivers/mtd/spi-nor/core.c > >> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct > >> spi_nor_erase_type *erase, u32 size, erase->size = size; > >> > >> erase->opcode = opcode; > >> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. > >> */ > >> > >> - erase->size_shift = ffs(erase->size) - 1; > >> - erase->size_mask = (1 << erase->size_shift) - 1; > >> + if (size) { > >> + erase->size_shift = ffs(size) - 1; > >> + erase->size_mask = (1 << erase->size_shift) - 1; > >> + } else { > >> + erase->size_shift = 0; > >> + erase->size_mask = 0; > >> + } > >> > >> } > >> > >> > >> > >> /** > > > > > > What is the status of this patch? It is not applied up until now, no? Has > > it been superseeded? > > > > > I think it's marked with "changes requested". I'm going to send a v2. Is there a v2 somewhere? Best regards, Alexander
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index 3d97c189c332..a1b5d5432f41 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, erase->size = size; erase->opcode = opcode; /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ - erase->size_shift = ffs(erase->size) - 1; - erase->size_mask = (1 << erase->size_shift) - 1; + if (size) { + erase->size_shift = ffs(size) - 1; + erase->size_mask = (1 << erase->size_shift) - 1; + } else { + erase->size_shift = 0; + erase->size_mask = 0; + } } /**
When paring SFDP we may choose to mask out an erase type, passing an erase size of zero to spi_nor_set_erase_type(). Fix shift-out-of-bounds and just clear the erase params when passing zero for erase size. While here avoid a superfluous dereference and use 'size' directly. UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Reported-by: Alexander Stein <Alexander.Stein@tq-group.com> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> --- drivers/mtd/spi-nor/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)