From patchwork Wed Jul 19 21:55:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe JAILLET X-Patchwork-Id: 1810058 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=sklen4Mr; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=wanadoo.fr header.i=@wanadoo.fr header.a=rsa-sha256 header.s=t20230301 header.b=W1NWYKvS; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4R5qQW0Whsz1yXp for ; Thu, 20 Jul 2023 07:56:19 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=4k1Ej587dOMynYHKWC9bZWwJKZbdmJHaR37QxlhItKU=; b=sklen4MrbCXny7 30iEn7/ijymf/+tBuQUUXctt8E0kPAcH6iJv87QQsEj6yl8KgunTqWTAjeLpTHRx3uEg6yt05Hi/M lqkTygEI8rGKEhbiokTJ+dS1729n5H8hzU+uwIYLPpU4ZYtwkMh2Y2v5tdFb1pXysWmOBGwN/Tboh VpqcKEqzelLtYp6EXKZeTkEm4G+x1bhrFtoteckbbQGCFWPZtJT0oaRqfnaBgCuAVEg9wNeA/nR4k NMRUb51uUTCL0jYcRzYjUFwMXkcsj6WQnMLUJf7G7Kg6/IbXk5aMFdWOorictOISk/PkiZdTkVPNB RfiQsD9qYU91+dYy43og==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qMF8t-0091Wm-1X; Wed, 19 Jul 2023 21:55:31 +0000 Received: from smtp-22.smtpout.orange.fr ([80.12.242.22] helo=smtp.smtpout.orange.fr) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qMF8o-0091Rk-2L for linux-mtd@lists.infradead.org; Wed, 19 Jul 2023 21:55:29 +0000 Received: from pop-os.home ([86.243.2.178]) by smtp.orange.fr with ESMTPA id MF8dq7PjtT4RdMF8dqgUPy; Wed, 19 Jul 2023 23:55:20 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wanadoo.fr; s=t20230301; t=1689803720; bh=HzYBbxpYE3IX2TCrR04zl6ewdpf4XKvAL64ilNVr08Q=; h=From:To:Cc:Subject:Date; b=W1NWYKvSI/IzA7HjoHwC98Y8+GYqVdCL4/63SaTE73QP5Tg/gmXrjVOb2UzIVucqK 8kirPYqzz8TCyTkAtxGHAzDl47IEL+CzjI52G8Oms5gj3loRQVbGTGE7lfJlF1Lu2Y +uL94r2Li4n6CHv1cgQX/Ca8F9guUE/gCpQayQta9w0n65amj58int/64YPOZdkddz Qwq8YRpSE1FmGApi1LQcuMRCksXOwW31Ge2Ys14pHP/f4q07yN+lt3vq2gK/AkFGvL zHFqET3z6QgoEznR+fT8w90jfHYLXCQTiHjB6CasG3lG97yta0aCEWYSQnYg4TIF+B a/0WIDdo1ndBQ== X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Wed, 19 Jul 2023 23:55:20 +0200 X-ME-IP: 86.243.2.178 From: Christophe JAILLET To: Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , Boris Brezillon Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-mtd@lists.infradead.org Subject: [PATCH] mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() Date: Wed, 19 Jul 2023 23:55:01 +0200 Message-Id: X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230719_145527_231434_BA82E828 X-CRM114-Status: GOOD ( 12.33 ) X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: 'op-cs' is copied in 'fun->mchip_number' which is used to access the 'mchip_offsets' and the 'rnb_gpio' arrays. These arrays have NAND_MAX_CHIPS elements, so the index must be below this limit. Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This would lead to out-of-bound accesses. Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [80.12.242.22 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [80.12.242.22 listed in wl.mailspike.net] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org 'op-cs' is copied in 'fun->mchip_number' which is used to access the 'mchip_offsets' and the 'rnb_gpio' arrays. These arrays have NAND_MAX_CHIPS elements, so the index must be below this limit. Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This would lead to out-of-bound accesses. Fixes: 54309d657767 ("mtd: rawnand: fsl_upm: Implement exec_op()") Signed-off-by: Christophe JAILLET Reviewed-by: Dan Carpenter --- drivers/mtd/nand/raw/fsl_upm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c index f1810e2f2c07..0c67fd1347c4 100644 --- a/drivers/mtd/nand/raw/fsl_upm.c +++ b/drivers/mtd/nand/raw/fsl_upm.c @@ -135,7 +135,7 @@ static int fun_exec_op(struct nand_chip *chip, const struct nand_operation *op, unsigned int i; int ret; - if (op->cs > NAND_MAX_CHIPS) + if (op->cs >= NAND_MAX_CHIPS) return -EINVAL; if (check_only)