From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7914842A7BD for ; Mon, 20 Jul 2026 14:13:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784556787; cv=none; b=Nft61NzAJcbENzrUZvH2y4SejgbJS5XTICuMJpLFiyYvVKBfKgM6VLPPWie5iwq1aPJAARguMjUsAoPpJXqC0EgKKT3JStUFQHz12HX2YeRPF/P0r0kUvognzH38amYkn4v15asBpbvfdpIO6adP0CpvST8VIHBLKBlnVxtYtFo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784556787; c=relaxed/simple; bh=ll/49uWw98HtG13jkCuju/9QKWipJ0XC4X80ruQl+0g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WHOOPgPXvoirgZPSneAarYPeXbl0M+DHgAjO62ShKpPObGQx0Ev5qO1ajBosxXlsGWeQ/NtRrCk0li50bnCv7J0WEz0wFZYXGzUqcMP5g3O8szs98dHZZaCQBeGXLLzvGcvjm3Ds730aJ+TiPiLOjSTujKoBthzggt6sw6494Bw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YUvz6sRX; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YUvz6sRX" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2caea3f742bso122051865ad.0 for ; Mon, 20 Jul 2026 07:13:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784556786; x=1785161586; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8N2Eh9+kjraqWaH+OPY3y8zXKExuWvOOjFqxAzkUc8Y=; b=YUvz6sRXLCKIUbvPwsr3z682faCfkRgi809np2S4wfrofdvICjkcq2Fkwb6Bx0+8Zl kS73aJylM9lfn2hP9knK4rphUQQ951M8NrC218NUdA2Wh/Csv5K8rNw6Ee/WvhCIDG/b Rzp8a0qGuLlgY0zsywmS6PdQ7/AbcB1eTFcu+kB1r+hFW6nT+wiRK2H6pDTVucQ358kG 2KIqUiJ2WAF6UE2Ff9utOYASZkJlepvWC0nOxCouikF4YjpuWu24WTbtyDO0YhECL+y2 BvqENTjpt/Ner8+8/YkxAr/P1NsBofKmbgskiD2zirVusvwYB1kQvcS/RLOVSJ8UC4zX kXQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784556786; x=1785161586; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8N2Eh9+kjraqWaH+OPY3y8zXKExuWvOOjFqxAzkUc8Y=; b=btwXJBlpSVAA0gFT12yTaWFlDKFmfe6u6U4WYEyNGHPjB8gJbW3+3owtlSm9iyYyvX wnE2+HyeoVeDOrUfrHDChj+6Tpbki5pInSemJ6lle1bvQNObiqu1XdOYjDTNbRcUkGa7 wni3EY+5CO72amm0A+eGUYF1hycy1UVGzUGvhvFA1MyMgREvhltQ70MGnGOXZ2aoM+3P 19wKkZke7PAxtg+PBbl/toppXgxP7DrNsSe/Zi07Cch+D2lZQLXslX7gUh2Ur4JnSXpn AfYnqV/mFJLui56g0Sfe9lPgK9J4/iZJXlR5ey3xhu0SZXW9Y+/tkIc5c/eUlBqlS+rx 4nKg== X-Forwarded-Encrypted: i=1; AHgh+RpjbxH/WQ1pxqt7Y3YBqC8+pE/lu9ywU/7e7IlpsPieQErTZinG0w5F3fe59FCPwb3uJnZPzKCKlLQ0Ses=@vger.kernel.org X-Gm-Message-State: AOJu0YzSQyIlrkbgePZYVzAoxBEaj9QjPUyJPEE3HNyyTJ8eVFV8LmTQ 5NJBmnILCaMkUAcAkL3AtBCfQD8/acpf1KtdKiE7nVla8akmSLUijgNE X-Gm-Gg: AR+sD12oX4NngAxYik8HCQVTxAzhX1/ND3F/XwFBfXT9S3PLlWQnrdmyljAvpez6Avn 8MwA09lamHV4nqWnWXPb9UDigwobfVjomt66ZldYZ7m/e0mIPJdc5ISHb4lfX6c76IudABRK7WY lOrIvZVojJIjBXGD2bu/PyiAJTWjm8q0A2ljSulOjGbd+/qRPYW+VqsFnb3QeZJjV1MG8+UecKn xjX35l5cWSGd4NabAb/TuG2MpK0SuhUYm1gcCSLhWFE0sry7zvkHW+csxiu+xrMdgtPAJUdtVps Rke7gkdcYDTWYmhYZvJc1Oba6potmJhhzkzMVhDB0LXVuJRSD+ORe5vUume+vN8sDVatRCO5pDm Vv8qFScYu5ML9xRB4rFn8itHPII4Zs5FQKLoR/zIlDO/D4Cv8gS4W4taGYxIFskWjYfyXIgfmby qPCOa1NDLx5Qlq7mQc1YjRZpuzjrnA6ywkwagnSxUWr38LdUuHzl2mN0O5TVt8iuaeWjc= X-Received: by 2002:a17:903:3243:b0:2ca:ca48:c36a with SMTP id d9443c01a7336-2cf348f9dc4mr150032705ad.18.1784556785760; Mon, 20 Jul 2026 07:13:05 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf34730e35sm57578155ad.64.2026.07.20.07.13.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 07:13:05 -0700 (PDT) From: HyeongJun An To: pratyush@kernel.org, mwalle@kernel.org, tudor.ambarus@linaro.org, miquel.raynal@bootlin.com, richard@nod.at, vigneshr@ti.com Cc: takahiro.kuwano@infineon.com, linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, HyeongJun An Subject: [PATCH v2 1/2] mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table Date: Mon, 20 Jul 2026 23:11:03 +0900 Message-ID: <20260720141104.2054417-2-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720141104.2054417-1-sammiee5311@gmail.com> References: <20260720141104.2054417-1-sammiee5311@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The spi_nor_parse_profile1() sizes its buffer from the table length the flash reports in the SFDP parameter header. But it then reads DWORD1, DWORD4 and DWORD5 without ever checking the table is that long. So if a flash reports a length of one, the buffer is only four bytes while DWORD4 and DWORD5 sit at byte offsets 12 and 16. With a length of zero kmalloc() returns ZERO_SIZE_PTR rather than an error, so the NULL check doesn't catch it and the first read dereferences it. And the value doesn't just get thrown away. It ends up as the dummy cycle count for 8D-8D-8D fast reads. To fix this, reject a table that's too short for the highest DWORD the parser reads, the way spi_nor_parse_4bait() already does. The table is optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and carries on. Fixes: fb27f198971a ("mtd: spi-nor: sfdp: parse xSPI Profile 1.0 table") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An --- drivers/mtd/spi-nor/sfdp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c index 4600983cb579..ece8bbd4bc47 100644 --- a/drivers/mtd/spi-nor/sfdp.c +++ b/drivers/mtd/spi-nor/sfdp.c @@ -1175,6 +1175,7 @@ static int spi_nor_parse_4bait(struct spi_nor *nor, #define PROFILE1_DWORD5_DUMMY_166MHZ GENMASK(31, 27) #define PROFILE1_DWORD5_DUMMY_133MHZ GENMASK(21, 17) #define PROFILE1_DWORD5_DUMMY_100MHZ GENMASK(11, 7) +#define SFDP_PROFILE1_DWORD_MIN 5 /** * spi_nor_parse_profile1() - parse the xSPI Profile 1.0 table @@ -1192,6 +1193,9 @@ static int spi_nor_parse_profile1(struct spi_nor *nor, int ret; u8 dummy, opcode; + if (profile1_header->length < SFDP_PROFILE1_DWORD_MIN) + return -EINVAL; + len = profile1_header->length * sizeof(*dwords); dwords = kmalloc(len, GFP_KERNEL); if (!dwords) -- 2.43.0