From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70C2D1A6838 for ; Sun, 19 Jul 2026 01:08:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784423317; cv=none; b=jFY8xfx7Pzbh83oed+xkL7UBsBhGjvfjgoRMJLSpTfHCjtybtlcbieIZmQl+qH3lwS/EChvaPalLq8cHXa68jpod/HAHQKhregZZW12hg2WYNXhLGxPrOy1FJ4uc9j8pzhimrtxl6ti4ruQjZM9HHVoPjUAFEDzY0ZGtXf2Wqjk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784423317; c=relaxed/simple; bh=VKMEI4O3cVms7BwzrmdSd1LsVh53CDmsQOARqM14ZxI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KKolzELb7AvWS9ndcCS3hdBE37KHJMu74Cm+cASFRnmoVFo9XUKjK9RACRbBCqjemfSdV1VRhNIPCp3gxvcqaxhpODnS6oVXBSsO7MRZv7mYnOcOoK+n0FV7lHISsmL65XuLKHqn5sjZ0eiieiwDKLsgDTouM4UKBYR1PvuNm0s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AQGJnYps; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AQGJnYps" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-ca97d139d8dso3417512a12.2 for ; Sat, 18 Jul 2026 18:08:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784423316; x=1785028116; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=i5qdSIBDIbeiuMoqbVIlnag+bM7io+xc2WQjdX5cfZY=; b=AQGJnYpsF+TbtZcuVemrPizm//+iMZ/8hYcoE1VCnFl+NlWXYA8HBFFb69RSiONt4Y izcEi2lMbG16UmLf5/kIdrGinQsx0sfXLokRHW8CTmjMS1sZ0s6DLRgbVrWlJEj0LlIe slNEwQnJVFk+Z0/Ae8lyyFDbae2KlTnw7xL8R6KJDw7oRG8APYBjGpxdilCByPud7Zl3 grVRUA6paUome1lz9pQt28hVs0OWimVnZqQcxEjOyF2Y387JuddF49xQTv+ww/tqE14x f/Ihb0zO+BoNlW5k/GFmVM7IOes+YGpeu2vEGb4u8ZkKWytsr1AFTKjGO0+r9MD8Hv4a 2cbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784423316; x=1785028116; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=i5qdSIBDIbeiuMoqbVIlnag+bM7io+xc2WQjdX5cfZY=; b=HdD60AOQO5lLEsE9E+Q6ey2aNUiljWTBPGZZruhnonr1Ch6QQQqcaUmtxGvi1nGCNS WoRIK8sK0JEO65X9ijlrOg9VT5RhwLsxt/yx/+XrPZ4qgg45KdrH1DbPhGaFFm4isfqW DqRm10Z7VrOM7L2KKgtk8M4xvCCT22fC+XQp4cwIomAqAJglEM3EqHjhoI65aBUE7zDZ m1fk6G5X8Wh2WOcEylLWzp6ISiiBQ0nbICxE/Bio6nJT+RxCTk/bBTI1LI45xxK36mHU MYxB5p/vrXqhwMXCixy6OUUY+QsLHJhlFj1oUzMB8nQFA36AGwzUH/CkZ8wAtvFBnYEk sAyA== X-Forwarded-Encrypted: i=1; AHgh+RpXgiT5lNx9ED1uJsSoQb4x4fnthp6pzLa7USQOd6/rwI2AjLIpWa201YMnULVlGW9/XmH/g4+Ain+gFYA=@vger.kernel.org X-Gm-Message-State: AOJu0Yy8oPn82jq6C8fC4cF1ZbuTMP/2ComHAxBxuiUPMctaQ4uWgwrw Ps4+duAOLn9+g/BydLf2cVXJW/VphxKZX3oZuXmagaDBs4tfwd7P4u3u X-Gm-Gg: AfdE7cmDTwFBHGIMxGhy7n2XjoZ+F3/5+QnqO/DmGIqYLFPbWjjrkEu04jhSPlgB9rZ 61wATZq/E3I4lTFE7Nt/YeetY5Lg3QE2wXLR4ORgj9uK8JVjWBn5rx4/hr5KNwqQcP35oWREgG2 48Sff3PY7n7XKssqjWbeVPpug7IKheAA0/lVSMbBGPJDPgpE7bQvt2zrM8aeNLqpPHXqsuVuIuJ W9M8ZzagizoJknX7zYVs510T8neaE7Ouds/1IqIVgGk2Vm3mgd6PXYCmUcCRCgEXCzT5vc/FAJt f0mHll4u2vcAHM7KvtBAeLHSWZJJghY4VhBQMeDitprmAxtesJMng3ZF3jrqbPq56X1aoz4rg/s xZt7IqVn3X2m9e2XbcZys8MbeVTce/iryiK37JN0U6sM96otpUDaOXDKw2augBHqkXZcCHFEIE+ REvcUFR+fgLrp7CxS08u2Qp4zupzSuBH9AnhSf4ATUfka7AaUa4fFb/Eps5caRvekCVOo= X-Received: by 2002:a05:6a00:451b:b0:848:7459:5f62 with SMTP id d2e1a72fcca58-84c2945a902mr8415573b3a.44.1784423315683; Sat, 18 Jul 2026 18:08:35 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2af9af73sm3446544b3a.53.2026.07.18.18.08.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jul 2026 18:08:35 -0700 (PDT) From: HyeongJun An To: Pratyush Yadav , Michael Walle , Tudor Ambarus , Miquel Raynal , Richard Weinberger , Vignesh Raghavendra Cc: Takahiro Kuwano , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, HyeongJun An Subject: [PATCH 2/2] mtd: spi-nor: sfdp: check the length of the SCCR map Date: Sun, 19 Jul 2026 10:08:20 +0900 Message-ID: <20260719010820.1924739-3-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260719010820.1924739-1-sammiee5311@gmail.com> References: <20260719010820.1924739-1-sammiee5311@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit spi_nor_parse_sccr() sizes its bounce buffer from the length the flash reports in the SFDP parameter header, then reads DWORD22 out of it: len = sccr_header->length * sizeof(*dwords); dwords = kmalloc(len, GFP_KERNEL); ... if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[SFDP_DWORD(22)])) Nothing checks that the table actually has 22 DWORDs. The length is a u8 the flash supplies, so a device advertising the SCCR map with a shorter length makes the read run past the allocation: with a length of one the buffer is four bytes and dwords[SFDP_DWORD(22)] reads eighty-four bytes beyond it. A length of zero is worse, as kmalloc() then returns ZERO_SIZE_PTR rather than an error and the read of dwords[SFDP_DWORD(1)] dereferences it. Reject a table shorter than the highest DWORD the parser reads, the way spi_nor_parse_4bait() already does with SFDP_4BAIT_DWORD_MAX. Failing an optional parameter table is not fatal: spi_nor_parse_sfdp() warns and carries on with the data gathered so far. spi_nor_parse_sccr_mc() does not need the same check. It derives the number of dice from the length it allocated with, so its highest index stays inside the buffer, and a length below two leaves its loop empty. Fixes: 7ab8b810757a ("mtd: spi-nor: sfdp: Add support for SCCR map for multi-chip device") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An --- drivers/mtd/spi-nor/sfdp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c index d3d85b5d1b4a..6c9db103a29a 100644 --- a/drivers/mtd/spi-nor/sfdp.c +++ b/drivers/mtd/spi-nor/sfdp.c @@ -1266,6 +1266,7 @@ static int spi_nor_parse_profile1(struct spi_nor *nor, } #define SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE BIT(31) +#define SFDP_SCCR_DWORD_MAX 22 /** * spi_nor_parse_sccr() - Parse the Status, Control and Configuration Register @@ -1284,6 +1285,9 @@ static int spi_nor_parse_sccr(struct spi_nor *nor, size_t len; int ret; + if (sccr_header->length < SFDP_SCCR_DWORD_MAX) + return -EINVAL; + len = sccr_header->length * sizeof(*dwords); dwords = kmalloc(len, GFP_KERNEL); if (!dwords) -- 2.43.0