From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 316F050276 for ; Sun, 19 Jul 2026 01:08:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784423309; cv=none; b=Rc/gH7fxTy6kYmjYIu9axABMqGl3zP63ZZAZy6/hmMmIu1BHJO1Jmxtpg+z3Myn3cCNicDa9vruRw5Y5hb2Zhmt6zQamG+C3OIXRWeMds14dFngYLzZpIYY6IS/g7Q8Qb7tjkSJYtOcR2t80rB2ufP2zDyfGePY3A5l0t8sdcH0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784423309; c=relaxed/simple; bh=igHWA+Xm8rtA+cYl/AfZubhzqAEmWgNqpRMKzAJh1j0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=d/igS+1NrCgbhaE80Dik/tWIXw90vTIUBQGCwQAKiOUkjp3CN7x6gAaQpeb39g9dGOt3mgLqTQsWqnn02eqZGJZRemwdAdJu2N6O9cU0uJiBrbn/z9wINuNMlDJzHpqJCmsJ+4JU94+fj9+VSilRa2yNYGLaReNCU3hBmixwJ5E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NcpAG7ti; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NcpAG7ti" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-8423f236418so4539285b3a.1 for ; Sat, 18 Jul 2026 18:08:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784423307; x=1785028107; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=DIdLJQoDNc4JYvLBvL2oNFaPJGBiZwdyTA21ZB8ViqM=; b=NcpAG7tiTY4asYM/770kd18shqqj/mcVB4MKw2bUOP1PA7L774imrQpOdR/avFOeC8 8EgiMRKVqvxfertLmJ+SkjjTHpcB51x1tBh3VgrGX20p2c6i427tYE/v0M1zIEHsjaib 3guDwgiDB+cE9yx9uvOupUnd75Jjm76oRBNxWKpQXKHVfkkO7U2PpzagsAA6YTXqim6u SOX0ZBl1lr+WttPlEzx42T5hcNlsm5ePei80iPKL2Vu9JzMufB2JYOwOb1xRILBz5MqP NATu9tMd9it+OnEroPUMzM/fBkKHhl4Kt9Opa700LoGKo9ZsIXDC3ol060qUv4Cvk+2y r88g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784423307; x=1785028107; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DIdLJQoDNc4JYvLBvL2oNFaPJGBiZwdyTA21ZB8ViqM=; b=Wj9AVl0vgGU7jJ9cTN9RJL3OFXBBh1ELVZONYaVlFR1M1m+kjxdmnr9rXE5g93QujP KZijFJhcYNj71Av7xPr6Lg6fwVFoTw+HiqRMd/hYOCOg0y6udvCcyFa0n/puyvdkJsh+ 3xHF63cJ1vNlAmtGUNDItnXU1pEoqg4IorX1uk4BVAPCZs+PRNkPR4g0y4OUlc6PGyON EDO117m8/3U83Ev61SxUM4IaGzfmNKZDsNROLe71+ohlN7+9L7gQtPGbxP3D0M9IHXV9 q+m6M+proD1HiF7sE6lLWj2g/25BHvNtZvz7ifuzXA0LRguiICFF+ZkRE90LZEsbyhnO ZX3Q== X-Forwarded-Encrypted: i=1; AHgh+RoBBURbFCGBINEMm5Oj8SNH+79VVU/oSEVqWkj81BGPH59smmSc5/KGi8YZedmSaOdpB0xMK+APaemATIE=@vger.kernel.org X-Gm-Message-State: AOJu0YwF40ftWgCF//2KhqSCGv+e8CPT65dAJbIRGSL19BkRXDl2sKf7 ssh0yQ1T7SLSz/62Dv2BhUmZTTIfLXSQRH4PnKsblb3Jm3lYTyxXT/zl X-Gm-Gg: AfdE7cmtA1RtteFDKlGc4+ML7cxP77q8QMkhwQ7j8IrOj15e78hGEBY/ZrYzqKAzp/u cljAXIBsrFAjDlafC3j1quc51z6tQ0MmnWm1Y4UU+JEOji04SxDGx3x30+FSog5UTBDR74KW5Iz P1+8QGSinIr6s1VNX34kLJaNJsdlfCJwWCes3zqze2KgJlGNmoiwuHIGep27dI2ErnHsf1IrW27 zhhdoQEg5mo7zTtySmA71ARGC94kuq6COBD0kUv9DyB+N2INFQKQ57AbwQ7KNaShHIFYT+d3dWP TbtNRgKyx7b0D0oXcKLKJgIw+xpMU+rOh3EycFLwOYdKJjt6s8osh/zmgshqxaJRcNY51fWQJR8 HBInNzmQsJ9H52Ic6NXuHEQlj+MA3MakpC0XyjFJu3oF96WLBvXX+ta8cxIvcuDbud/XEbjBifL 9PIAOx7l93/XfhiFRgu0C0VN9O9UPCRnCL5+XEX5EyS5CDmQD0cCMuLzmIzF7XqVGjgVw= X-Received: by 2002:a05:6a00:887:b0:847:8d2d:713c with SMTP id d2e1a72fcca58-84c295016f5mr8267340b3a.50.1784423307388; Sat, 18 Jul 2026 18:08:27 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2af9af73sm3446544b3a.53.2026.07.18.18.08.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jul 2026 18:08:26 -0700 (PDT) From: HyeongJun An To: Pratyush Yadav , Michael Walle , Tudor Ambarus , Miquel Raynal , Richard Weinberger , Vignesh Raghavendra Cc: Takahiro Kuwano , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, HyeongJun An Subject: [PATCH 0/2] mtd: spi-nor: sfdp: bound two optional parameter tables Date: Sun, 19 Jul 2026 10:08:18 +0900 Message-ID: <20260719010820.1924739-1-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Two of the optional SFDP parameter table parsers allocate a bounce buffer from the table length the flash reports, then index it at fixed offsets without checking the table is long enough to hold them. spi_nor_parse_profile1() reads up to DWORD5, never checks the length spi_nor_parse_sccr() reads up to DWORD22, never checks the length The length is a u8 supplied by the flash, so a device that advertises either table with a shorter length makes the read run past the allocation, and a length of zero makes kmalloc() hand back ZERO_SIZE_PTR, which the parsers then dereference. spi_nor_parse_4bait() already guards its table this way with SFDP_4BAIT_DWORD_MAX, so both patches just apply the same check. spi_nor_parse_sccr_mc() is left alone: it derives its highest index from the length it allocated with, so it stays in bounds. The two parsers were added at different times, so they carry different Fixes tags and are split into one patch each. Found by code inspection; I have no xSPI or multi-die part to reproduce this on, so this is not runtime tested. HyeongJun An (2): mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table mtd: spi-nor: sfdp: check the length of the SCCR map drivers/mtd/spi-nor/sfdp.c | 8 ++++++++ 1 file changed, 8 insertions(+) -- 2.43.0