* [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
@ 2021-11-06 7:56 ` Tudor Ambarus
0 siblings, 0 replies; 18+ messages in thread
From: Tudor Ambarus @ 2021-11-06 7:56 UTC (permalink / raw)
To: Alexander.Stein, michael, p.yadav, vigneshr
Cc: linux-mtd, linux-kernel, Tudor Ambarus
When paring SFDP we may choose to mask out an erase type, passing
an erase size of zero to spi_nor_set_erase_type().
Fix shift-out-of-bounds and just clear the erase params when
passing zero for erase size.
While here avoid a superfluous dereference and use 'size' directly.
UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
shift exponent 4294967295 is too large for 32-bit type 'int'
Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories")
Reported-by: Alexander Stein <Alexander.Stein@tq-group.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
---
drivers/mtd/spi-nor/core.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 3d97c189c332..a1b5d5432f41 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size,
erase->size = size;
erase->opcode = opcode;
/* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
- erase->size_shift = ffs(erase->size) - 1;
- erase->size_mask = (1 << erase->size_shift) - 1;
+ if (size) {
+ erase->size_shift = ffs(size) - 1;
+ erase->size_mask = (1 << erase->size_shift) - 1;
+ } else {
+ erase->size_shift = 0;
+ erase->size_mask = 0;
+ }
}
/**
--
2.25.1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 18+ messages in thread
* Re: (EXT) [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
2021-11-06 7:56 ` Tudor Ambarus
@ 2021-11-08 9:26 ` Stein, Alexander
-1 siblings, 0 replies; 18+ messages in thread
From: Stein, Alexander @ 2021-11-08 9:26 UTC (permalink / raw)
To: p.yadav, vigneshr, michael, tudor.ambarus; +Cc: linux-kernel, linux-mtd
Am Samstag, dem 06.11.2021 um 09:56 +0200 schrieb Tudor Ambarus:
> When paring SFDP we may choose to mask out an erase type, passing
> an erase size of zero to spi_nor_set_erase_type().
> Fix shift-out-of-bounds and just clear the erase params when
> passing zero for erase size.
> While here avoid a superfluous dereference and use 'size' directly.
>
> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> shift exponent 4294967295 is too large for 32-bit type 'int'
>
> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP
> SPI NOR flash memories")
> Reported-by: Alexander Stein <
> Alexander.Stein@tq-group.com
> >
> Signed-off-by: Tudor Ambarus <
> tudor.ambarus@microchip.com
> >
> ---
> drivers/mtd/spi-nor/core.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 3d97c189c332..a1b5d5432f41 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct
> spi_nor_erase_type *erase, u32 size,
> erase->size = size;
> erase->opcode = opcode;
> /* JEDEC JESD216B Standard imposes erase sizes to be power of
> 2. */
> - erase->size_shift = ffs(erase->size) - 1;
> - erase->size_mask = (1 << erase->size_shift) - 1;
> + if (size) {
> + erase->size_shift = ffs(size) - 1;
> + erase->size_mask = (1 << erase->size_shift) - 1;
> + } else {
> + erase->size_shift = 0;
> + erase->size_mask = 0;
> + }
> }
>
> /**
Tested-By: Alexander Stein <Alexander.Stein@tq-group.com>
It fixes the UBSAN error and my spi-nor flash can still be detected.
Best regards,
Alexander
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: (EXT) [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
@ 2021-11-08 9:26 ` Stein, Alexander
0 siblings, 0 replies; 18+ messages in thread
From: Stein, Alexander @ 2021-11-08 9:26 UTC (permalink / raw)
To: p.yadav, vigneshr, michael, tudor.ambarus; +Cc: linux-kernel, linux-mtd
Am Samstag, dem 06.11.2021 um 09:56 +0200 schrieb Tudor Ambarus:
> When paring SFDP we may choose to mask out an erase type, passing
> an erase size of zero to spi_nor_set_erase_type().
> Fix shift-out-of-bounds and just clear the erase params when
> passing zero for erase size.
> While here avoid a superfluous dereference and use 'size' directly.
>
> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> shift exponent 4294967295 is too large for 32-bit type 'int'
>
> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP
> SPI NOR flash memories")
> Reported-by: Alexander Stein <
> Alexander.Stein@tq-group.com
> >
> Signed-off-by: Tudor Ambarus <
> tudor.ambarus@microchip.com
> >
> ---
> drivers/mtd/spi-nor/core.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 3d97c189c332..a1b5d5432f41 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct
> spi_nor_erase_type *erase, u32 size,
> erase->size = size;
> erase->opcode = opcode;
> /* JEDEC JESD216B Standard imposes erase sizes to be power of
> 2. */
> - erase->size_shift = ffs(erase->size) - 1;
> - erase->size_mask = (1 << erase->size_shift) - 1;
> + if (size) {
> + erase->size_shift = ffs(size) - 1;
> + erase->size_mask = (1 << erase->size_shift) - 1;
> + } else {
> + erase->size_shift = 0;
> + erase->size_mask = 0;
> + }
> }
>
> /**
Tested-By: Alexander Stein <Alexander.Stein@tq-group.com>
It fixes the UBSAN error and my spi-nor flash can still be detected.
Best regards,
Alexander
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
2021-11-06 7:56 ` Tudor Ambarus
@ 2021-11-16 18:36 ` Pratyush Yadav
-1 siblings, 0 replies; 18+ messages in thread
From: Pratyush Yadav @ 2021-11-16 18:36 UTC (permalink / raw)
To: Tudor Ambarus; +Cc: Alexander.Stein, michael, vigneshr, linux-mtd, linux-kernel
On 06/11/21 09:56AM, Tudor Ambarus wrote:
> When paring SFDP we may choose to mask out an erase type, passing
> an erase size of zero to spi_nor_set_erase_type().
> Fix shift-out-of-bounds and just clear the erase params when
> passing zero for erase size.
> While here avoid a superfluous dereference and use 'size' directly.
>
> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> shift exponent 4294967295 is too large for 32-bit type 'int'
>
> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories")
> Reported-by: Alexander Stein <Alexander.Stein@tq-group.com>
> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
> ---
> drivers/mtd/spi-nor/core.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 3d97c189c332..a1b5d5432f41 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size,
> erase->size = size;
> erase->opcode = opcode;
> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
The change itself looks fine to me. So,
Reviewed-by: Pratyush Yadav <p.yadav@ti.com>
But I wonder if this code is doing the right thing. If a flash is
setting an incorrect erase size, shouldn't we fail loudly to make sure
the error is corrected, instead of working around it silently?
If you don't want to return an error here, how about:
WARN_ON(ffs(size) != fls(size))
or even a dev_warn() print so the programmer is aware of this.
> - erase->size_shift = ffs(erase->size) - 1;
> - erase->size_mask = (1 << erase->size_shift) - 1;
> + if (size) {
> + erase->size_shift = ffs(size) - 1;
> + erase->size_mask = (1 << erase->size_shift) - 1;
> + } else {
> + erase->size_shift = 0;
> + erase->size_mask = 0;
> + }
> }
>
> /**
> --
> 2.25.1
>
--
Regards,
Pratyush Yadav
Texas Instruments Inc.
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
@ 2021-11-16 18:36 ` Pratyush Yadav
0 siblings, 0 replies; 18+ messages in thread
From: Pratyush Yadav @ 2021-11-16 18:36 UTC (permalink / raw)
To: Tudor Ambarus; +Cc: Alexander.Stein, michael, vigneshr, linux-mtd, linux-kernel
On 06/11/21 09:56AM, Tudor Ambarus wrote:
> When paring SFDP we may choose to mask out an erase type, passing
> an erase size of zero to spi_nor_set_erase_type().
> Fix shift-out-of-bounds and just clear the erase params when
> passing zero for erase size.
> While here avoid a superfluous dereference and use 'size' directly.
>
> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> shift exponent 4294967295 is too large for 32-bit type 'int'
>
> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories")
> Reported-by: Alexander Stein <Alexander.Stein@tq-group.com>
> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
> ---
> drivers/mtd/spi-nor/core.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 3d97c189c332..a1b5d5432f41 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size,
> erase->size = size;
> erase->opcode = opcode;
> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
The change itself looks fine to me. So,
Reviewed-by: Pratyush Yadav <p.yadav@ti.com>
But I wonder if this code is doing the right thing. If a flash is
setting an incorrect erase size, shouldn't we fail loudly to make sure
the error is corrected, instead of working around it silently?
If you don't want to return an error here, how about:
WARN_ON(ffs(size) != fls(size))
or even a dev_warn() print so the programmer is aware of this.
> - erase->size_shift = ffs(erase->size) - 1;
> - erase->size_mask = (1 << erase->size_shift) - 1;
> + if (size) {
> + erase->size_shift = ffs(size) - 1;
> + erase->size_mask = (1 << erase->size_shift) - 1;
> + } else {
> + erase->size_shift = 0;
> + erase->size_mask = 0;
> + }
> }
>
> /**
> --
> 2.25.1
>
--
Regards,
Pratyush Yadav
Texas Instruments Inc.
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
2021-11-06 7:56 ` Tudor Ambarus
@ 2022-03-16 7:39 ` Alexander Stein
-1 siblings, 0 replies; 18+ messages in thread
From: Alexander Stein @ 2022-03-16 7:39 UTC (permalink / raw)
To: linux-mtd
Cc: michael, p.yadav, vigneshr, Tudor Ambarus, linux-kernel, Tudor Ambarus
Hello,
Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus:
> When paring SFDP we may choose to mask out an erase type, passing
> an erase size of zero to spi_nor_set_erase_type().
> Fix shift-out-of-bounds and just clear the erase params when
> passing zero for erase size.
> While here avoid a superfluous dereference and use 'size' directly.
>
> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> shift exponent 4294967295 is too large for 32-bit type 'int'
>
> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR
> flash memories") Reported-by: Alexander Stein
> <Alexander.Stein@tq-group.com>
> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
> ---
> drivers/mtd/spi-nor/core.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 3d97c189c332..a1b5d5432f41 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type
> *erase, u32 size, erase->size = size;
> erase->opcode = opcode;
> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
> - erase->size_shift = ffs(erase->size) - 1;
> - erase->size_mask = (1 << erase->size_shift) - 1;
> + if (size) {
> + erase->size_shift = ffs(size) - 1;
> + erase->size_mask = (1 << erase->size_shift) - 1;
> + } else {
> + erase->size_shift = 0;
> + erase->size_mask = 0;
> + }
> }
>
> /**
What is the status of this patch? It is not applied up until now, no? Has it
been superseeded?
Regards,
Alexander
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
@ 2022-03-16 7:39 ` Alexander Stein
0 siblings, 0 replies; 18+ messages in thread
From: Alexander Stein @ 2022-03-16 7:39 UTC (permalink / raw)
To: linux-mtd
Cc: michael, p.yadav, vigneshr, Tudor Ambarus, linux-kernel, Tudor Ambarus
Hello,
Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus:
> When paring SFDP we may choose to mask out an erase type, passing
> an erase size of zero to spi_nor_set_erase_type().
> Fix shift-out-of-bounds and just clear the erase params when
> passing zero for erase size.
> While here avoid a superfluous dereference and use 'size' directly.
>
> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> shift exponent 4294967295 is too large for 32-bit type 'int'
>
> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR
> flash memories") Reported-by: Alexander Stein
> <Alexander.Stein@tq-group.com>
> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
> ---
> drivers/mtd/spi-nor/core.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 3d97c189c332..a1b5d5432f41 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type
> *erase, u32 size, erase->size = size;
> erase->opcode = opcode;
> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
> - erase->size_shift = ffs(erase->size) - 1;
> - erase->size_mask = (1 << erase->size_shift) - 1;
> + if (size) {
> + erase->size_shift = ffs(size) - 1;
> + erase->size_mask = (1 << erase->size_shift) - 1;
> + } else {
> + erase->size_shift = 0;
> + erase->size_mask = 0;
> + }
> }
>
> /**
What is the status of this patch? It is not applied up until now, no? Has it
been superseeded?
Regards,
Alexander
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
2022-03-16 7:39 ` Alexander Stein
@ 2022-03-16 7:47 ` Tudor.Ambarus
-1 siblings, 0 replies; 18+ messages in thread
From: Tudor.Ambarus @ 2022-03-16 7:47 UTC (permalink / raw)
To: Alexander.Stein, linux-mtd; +Cc: michael, p.yadav, vigneshr, linux-kernel
On 3/16/22 09:39, Alexander Stein wrote:
> [You don't often get email from alexander.stein@tq-group.com. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.]
>
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>
> Hello,
hi,
>
> Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus:
>> When paring SFDP we may choose to mask out an erase type, passing
>> an erase size of zero to spi_nor_set_erase_type().
>> Fix shift-out-of-bounds and just clear the erase params when
>> passing zero for erase size.
>> While here avoid a superfluous dereference and use 'size' directly.
>>
>> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
>> shift exponent 4294967295 is too large for 32-bit type 'int'
>>
>> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR
>> flash memories") Reported-by: Alexander Stein
>> <Alexander.Stein@tq-group.com>
>> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
>> ---
>> drivers/mtd/spi-nor/core.c | 9 +++++++--
>> 1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
>> index 3d97c189c332..a1b5d5432f41 100644
>> --- a/drivers/mtd/spi-nor/core.c
>> +++ b/drivers/mtd/spi-nor/core.c
>> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type
>> *erase, u32 size, erase->size = size;
>> erase->opcode = opcode;
>> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
>> - erase->size_shift = ffs(erase->size) - 1;
>> - erase->size_mask = (1 << erase->size_shift) - 1;
>> + if (size) {
>> + erase->size_shift = ffs(size) - 1;
>> + erase->size_mask = (1 << erase->size_shift) - 1;
>> + } else {
>> + erase->size_shift = 0;
>> + erase->size_mask = 0;
>> + }
>> }
>>
>> /**
>
> What is the status of this patch? It is not applied up until now, no? Has it
> been superseeded?
>
I think it's marked with "changes requested". I'm going to send a v2.
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
@ 2022-03-16 7:47 ` Tudor.Ambarus
0 siblings, 0 replies; 18+ messages in thread
From: Tudor.Ambarus @ 2022-03-16 7:47 UTC (permalink / raw)
To: Alexander.Stein, linux-mtd; +Cc: michael, p.yadav, vigneshr, linux-kernel
On 3/16/22 09:39, Alexander Stein wrote:
> [You don't often get email from alexander.stein@tq-group.com. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.]
>
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>
> Hello,
hi,
>
> Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus:
>> When paring SFDP we may choose to mask out an erase type, passing
>> an erase size of zero to spi_nor_set_erase_type().
>> Fix shift-out-of-bounds and just clear the erase params when
>> passing zero for erase size.
>> While here avoid a superfluous dereference and use 'size' directly.
>>
>> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
>> shift exponent 4294967295 is too large for 32-bit type 'int'
>>
>> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR
>> flash memories") Reported-by: Alexander Stein
>> <Alexander.Stein@tq-group.com>
>> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
>> ---
>> drivers/mtd/spi-nor/core.c | 9 +++++++--
>> 1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
>> index 3d97c189c332..a1b5d5432f41 100644
>> --- a/drivers/mtd/spi-nor/core.c
>> +++ b/drivers/mtd/spi-nor/core.c
>> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type
>> *erase, u32 size, erase->size = size;
>> erase->opcode = opcode;
>> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2. */
>> - erase->size_shift = ffs(erase->size) - 1;
>> - erase->size_mask = (1 << erase->size_shift) - 1;
>> + if (size) {
>> + erase->size_shift = ffs(size) - 1;
>> + erase->size_mask = (1 << erase->size_shift) - 1;
>> + } else {
>> + erase->size_shift = 0;
>> + erase->size_mask = 0;
>> + }
>> }
>>
>> /**
>
> What is the status of this patch? It is not applied up until now, no? Has it
> been superseeded?
>
I think it's marked with "changes requested". I'm going to send a v2.
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
2022-03-16 7:47 ` Tudor.Ambarus
@ 2023-01-23 15:02 ` Stein, Alexander
-1 siblings, 0 replies; 18+ messages in thread
From: Stein, Alexander @ 2023-01-23 15:02 UTC (permalink / raw)
To: linux-mtd, Tudor.Ambarus; +Cc: michael, p.yadav, vigneshr, linux-kernel
Hi Tudor,
Am Mittwoch, 16. März 2022, 08:47:40 CET schrieb Tudor.Ambarus@microchip.com:
> On 3/16/22 09:39, Alexander Stein wrote:
>
> > [You don't often get email from alexander.stein@tq-group.com. Learn why
> > this is important at http://aka.ms/LearnAboutSenderIdentification.]
> > EXTERNAL EMAIL: Do not click links or open attachments unless you know the
> > content is safe
> > Hello,
>
>
> hi,
>
>
> >
> > Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus:
> >
> >> When paring SFDP we may choose to mask out an erase type, passing
> >> an erase size of zero to spi_nor_set_erase_type().
> >> Fix shift-out-of-bounds and just clear the erase params when
> >> passing zero for erase size.
> >> While here avoid a superfluous dereference and use 'size' directly.
> >>
> >>
> >>
> >> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> >> shift exponent 4294967295 is too large for 32-bit type 'int'
> >>
> >>
> >>
> >> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI
> >> NOR
flash memories") Reported-by: Alexander Stein
> >> <Alexander.Stein@tq-group.com>
> >> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
> >> ---
> >>
> >> drivers/mtd/spi-nor/core.c | 9 +++++++--
> >> 1 file changed, 7 insertions(+), 2 deletions(-)
> >>
> >>
> >>
> >> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> >> index 3d97c189c332..a1b5d5432f41 100644
> >> --- a/drivers/mtd/spi-nor/core.c
> >> +++ b/drivers/mtd/spi-nor/core.c
> >> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct
> >> spi_nor_erase_type
*erase, u32 size, erase->size = size;
> >>
> >> erase->opcode = opcode;
> >> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2.
> >> */
> >>
> >> - erase->size_shift = ffs(erase->size) - 1;
> >> - erase->size_mask = (1 << erase->size_shift) - 1;
> >> + if (size) {
> >> + erase->size_shift = ffs(size) - 1;
> >> + erase->size_mask = (1 << erase->size_shift) - 1;
> >> + } else {
> >> + erase->size_shift = 0;
> >> + erase->size_mask = 0;
> >> + }
> >>
> >> }
> >>
> >>
> >>
> >> /**
> >
> >
> > What is the status of this patch? It is not applied up until now, no? Has
> > it
been superseeded?
> >
>
>
> I think it's marked with "changes requested". I'm going to send a v2.
Is there a v2 somewhere?
Best regards,
Alexander
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 1/2] mtd: spi-nor: Fix shift-out-of-bounds
@ 2023-01-23 15:02 ` Stein, Alexander
0 siblings, 0 replies; 18+ messages in thread
From: Stein, Alexander @ 2023-01-23 15:02 UTC (permalink / raw)
To: linux-mtd, Tudor.Ambarus; +Cc: michael, p.yadav, vigneshr, linux-kernel
Hi Tudor,
Am Mittwoch, 16. März 2022, 08:47:40 CET schrieb Tudor.Ambarus@microchip.com:
> On 3/16/22 09:39, Alexander Stein wrote:
>
> > [You don't often get email from alexander.stein@tq-group.com. Learn why
> > this is important at http://aka.ms/LearnAboutSenderIdentification.]
> > EXTERNAL EMAIL: Do not click links or open attachments unless you know the
> > content is safe
> > Hello,
>
>
> hi,
>
>
> >
> > Am Samstag, 6. November 2021, 08:56:15 CET schrieb Tudor Ambarus:
> >
> >> When paring SFDP we may choose to mask out an erase type, passing
> >> an erase size of zero to spi_nor_set_erase_type().
> >> Fix shift-out-of-bounds and just clear the erase params when
> >> passing zero for erase size.
> >> While here avoid a superfluous dereference and use 'size' directly.
> >>
> >>
> >>
> >> UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
> >> shift exponent 4294967295 is too large for 32-bit type 'int'
> >>
> >>
> >>
> >> Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI
> >> NOR
flash memories") Reported-by: Alexander Stein
> >> <Alexander.Stein@tq-group.com>
> >> Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
> >> ---
> >>
> >> drivers/mtd/spi-nor/core.c | 9 +++++++--
> >> 1 file changed, 7 insertions(+), 2 deletions(-)
> >>
> >>
> >>
> >> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> >> index 3d97c189c332..a1b5d5432f41 100644
> >> --- a/drivers/mtd/spi-nor/core.c
> >> +++ b/drivers/mtd/spi-nor/core.c
> >> @@ -2230,8 +2230,13 @@ void spi_nor_set_erase_type(struct
> >> spi_nor_erase_type
*erase, u32 size, erase->size = size;
> >>
> >> erase->opcode = opcode;
> >> /* JEDEC JESD216B Standard imposes erase sizes to be power of 2.
> >> */
> >>
> >> - erase->size_shift = ffs(erase->size) - 1;
> >> - erase->size_mask = (1 << erase->size_shift) - 1;
> >> + if (size) {
> >> + erase->size_shift = ffs(size) - 1;
> >> + erase->size_mask = (1 << erase->size_shift) - 1;
> >> + } else {
> >> + erase->size_shift = 0;
> >> + erase->size_mask = 0;
> >> + }
> >>
> >> }
> >>
> >>
> >>
> >> /**
> >
> >
> > What is the status of this patch? It is not applied up until now, no? Has
> > it
been superseeded?
> >
>
>
> I think it's marked with "changes requested". I'm going to send a v2.
Is there a v2 somewhere?
Best regards,
Alexander
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 18+ messages in thread