From patchwork Sat Nov 6 07:56:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tudor Ambarus X-Patchwork-Id: 1551611 X-Patchwork-Delegate: tudor.ambarus@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=ZB5CMvX6; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=microchip.com header.i=@microchip.com header.a=rsa-sha256 header.s=mchp header.b=OsjqqzTT; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4HmV8l1yLdz9ssD for ; Sat, 6 Nov 2021 18:57:27 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=vCmHh/ijj9ijLM4AlmQxEtKRlGdZN5qZIaiKfFTavw0=; b=ZB5CMvX6k7vWmx cxSRZo4sv9hC2/4HmUb5WBZ/h1EwFakCh4KWA29Qva6CZi2oC3wd9TeRRngVp6fv0UcrXFmSXNOm5 BAza+RKtbNxPdzb1/63vDLDVDnC67A5lXSfR4QYIUK4U0Ith5uJJRyhVZJMT7OnYF3f0ZyM129SCY FXa7eIXX+hznW0IF0LZGF8PL0lA6m9csMLfyNzuhU4dsRa4hC3t8PZo1zyFdBMk1LZTux1sIhM+fa yx3r+Vm1f0rFC3pKvio46RHkjGlVgtZqcrrPZ96SiI6hmjScmtUP36fXROxzAx7xpge+A2wH/1fRj tLHAVAi/YzBI9vFgW2cw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mjGZ7-00Cm81-OH; Sat, 06 Nov 2021 07:56:41 +0000 Received: from esa.microchip.iphmx.com ([68.232.153.233]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mjGYr-00Cm4V-7m for linux-mtd@lists.infradead.org; Sat, 06 Nov 2021 07:56:26 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1636185385; x=1667721385; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=1hiT/iIgFr9BAOgFai4frwzmFe3aJdvpP7oNILgTiQ4=; b=OsjqqzTTZjUWab/41fVH+AUd9HEG4vlT/NpY9egXNXyPUQlrseUcofpB HCgm6OP5oawKYarnP8o1CZIBL1y/sj5hxrQZ53hkIJoCXbuJ0OZenBWKo 9i4BwlVMpVEvfVtzqrIy3JmImCGNq3yQSVdxdNGrGWHlkR03I/tLF2muL HjH7cz9kveZbTjOqa8kGHANPolpb5ttKvRwftWE3z0UVFOGWcORwjb9Zs 4LgIG309IOEn7FX0bU2sKSK6+WTx544MYwJCdYOEiZDU5OV052Iusp4XU z/9muscYL+okMQy7yPSNck53fObY/DMU4obOxwQbBjJ4qAdnXtjRiQ3zx Q==; IronPort-SDR: ZFzpXZudR4g9mjF3bnulaoIZz8Cnn9dXlfmIToUOkhQSf7ak2lhTFK+ssgrkUqY/E0YQhNhUaa AxpeOlpWvpjVMMcNkjaenI8AdYWofNLKhdD3VY9sMvplv9omGWWTsGzKCiiBbl3tvznvm0+ExR DDfrqRCkeJbdMXlq+bw8PTrlqYVEHsT/VGuFjnX3hPdW3wlDe3uymHv8T1rPINNjhzS7F31oc1 BtJ8Z3c9gFE/6Gr3SOqwI6no9CQexsyR6xTmka5Oo3rM5J/aWYamKNawdcWQDTsUiStdj2kE3q /ZeySTxOMPYpdsN9YjVaInsn X-IronPort-AV: E=Sophos;i="5.87,213,1631602800"; d="scan'208";a="142410383" Received: from smtpout.microchip.com (HELO email.microchip.com) ([198.175.253.82]) by esa5.microchip.iphmx.com with ESMTP/TLS/AES256-SHA256; 06 Nov 2021 00:56:23 -0700 Received: from chn-vm-ex01.mchp-main.com (10.10.85.143) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.14; Sat, 6 Nov 2021 00:56:22 -0700 Received: from ROB-ULT-M18064N.mchp-main.com (10.10.115.15) by chn-vm-ex01.mchp-main.com (10.10.85.143) with Microsoft SMTP Server id 15.1.2176.14 via Frontend Transport; Sat, 6 Nov 2021 00:56:20 -0700 From: Tudor Ambarus To: , , , CC: , , "Tudor Ambarus" Subject: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds Date: Sat, 6 Nov 2021 09:56:15 +0200 Message-ID: <20211106075616.95401-2-tudor.ambarus@microchip.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211106075616.95401-1-tudor.ambarus@microchip.com> References: <20211106075616.95401-1-tudor.ambarus@microchip.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211106_005625_312830_1CA794AC X-CRM114-Status: UNSURE ( 9.40 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.7 (--) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: When paring SFDP we may choose to mask out an erase type, passing an erase size of zero to spi_nor_set_erase_type(). Fix shift-out-of-bounds and just clear the erase params when passing zero for erase [...] Content analysis details: (-2.7 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [68.232.153.233 listed in list.dnswl.org] 0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [68.232.153.233 listed in wl.mailspike.net] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders -0.2 DKIMWL_WL_HIGH DKIMwl.org - High trust sender X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org When paring SFDP we may choose to mask out an erase type, passing an erase size of zero to spi_nor_set_erase_type(). Fix shift-out-of-bounds and just clear the erase params when passing zero for erase size. While here avoid a superfluous dereference and use 'size' directly. UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Reported-by: Alexander Stein Signed-off-by: Tudor Ambarus Tested-By: Alexander Stein Reviewed-by: Pratyush Yadav --- drivers/mtd/spi-nor/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index 3d97c189c332..a1b5d5432f41 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, erase->size = size; erase->opcode = opcode; /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */ - erase->size_shift = ffs(erase->size) - 1; - erase->size_mask = (1 << erase->size_shift) - 1; + if (size) { + erase->size_shift = ffs(size) - 1; + erase->size_mask = (1 << erase->size_shift) - 1; + } else { + erase->size_shift = 0; + erase->size_mask = 0; + } } /**