From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC88442B32D for ; Mon, 20 Jul 2026 14:13:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784556792; cv=none; b=IdV2jh9gQQOuthR3XojVaPxPXSpTKyNMSXEz97tR86QsvfphG5dNWIkg/66k+N5b3eNs4/MXjOosx4vQJY5yfrwIFjueW/XxY5YCoWkLaZCBs4BE6u+9uLE+DWmvluqjelpIl3kVSGiEukXaGRN21yU3UVTc1FosYhtsTD9jVno= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784556792; c=relaxed/simple; bh=itB2O4GUgGv95QM0OP7pQVex4/safeVqHqwTGlJLAw8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DQE+vEtqkf3TsXBGC/ScGbYKpUw98VbznE6WqZtU7UFHD1YrsoESiR8AeVrKH8JOCbpiQzjl17omY9+0E0jexv6C2tFjfz+zD+0VCMfEv1kXoh16a7i0CBWu3SmCtosegETqDjKxN+1mSmylPHPcvpDnzljg1qG/rAIqjPapmgQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=T1zv1Glt; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="T1zv1Glt" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2ceaf8a1265so98989335ad.2 for ; Mon, 20 Jul 2026 07:13:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784556791; x=1785161591; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=b8XF7nrzvK9JY0N2y+Fglwp5PAhvkeA4CdEStxZj/5I=; b=T1zv1Glt7Jkta70E8ULlx0lpkHv+I2u/NFaaP/FhIolf0jJFVyVan7q0w/wS9hGBpu 5mH5azZ6cR7sSdkagz43S6NCeBQW/a1QJ3fVyd1bB6U3S7M7gsDHawy8ToJDtGxzO3+z 0PiDZLtVMEaNOK+OYC8jQGTabZ2yxrtzHHMY6g6H4ebWcdNPN0Tni4D9gWq8pUHJMLUg wQ5asiBvelb3Isy2AfkbW+zMn+G8vkSsTXLQUUZyO0nm+Ec3t1UGRCpVQqvrV29+1frH Ro5jbAxcHD5HZo8lDDJNEpBUGwWgkBjmskRVKYTGIpoZfs9U4PHi65qtj2GQ4+VIE8e0 N/Sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784556791; x=1785161591; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=b8XF7nrzvK9JY0N2y+Fglwp5PAhvkeA4CdEStxZj/5I=; b=eQH5K9ohd0xBjln9XO2nCylPIrYWfoHkhxo2T6WW1gVhioYUm/UrJ3utp+nDVbEyMD aI2J3grocJuvPQePL7L5JoOvFX4c9utpMB9P3DWPv5Hf9PJ+882fhjtt316fLbB03VYz 8xRQl/CctDMrk3kZqLI97t+fEWbem8joTRAbX67jy1jW4x+YH0BY+Pai7B+jr6T+/4sy GB5GcV7Kx9c1V+Ol9e7am0tCmSXYrWQnXPL+JCfyeS6xifE1Q6HKegehfmtoir6USOAd vKjiTzsObKxxHT+UF4EAj9AuRoMFhePqGoF5fboJsa5sr0MlILO9E5xF/Cn8fip+IJPt CrpA== X-Forwarded-Encrypted: i=1; AHgh+Rr0cIrtky75p/eFYpnEpE/xHoprlIXeXWAy+2/vVh6J7ahz9lj154s5BbamAfSANvMORH2jhXDnfgxICxs=@vger.kernel.org X-Gm-Message-State: AOJu0YzsqEsh2X8Kl1cpJ6vjULEAt80hJ/9Qf9t3/3wf53uVsu/iCyPK mR/UYEUlMB5suHQ3t6a8SBmZNP/5OYwQic7pKqnMDcS6QcwprTZh8SXY X-Gm-Gg: AR+sD10sNBRC6/KHQCiU08UsRlWO15erZrKaw6L+FRdMaax4nTnRpJigCAbmIZdvzeC S/Iacxmktu8isc1yhfkM4WxUXm91hcVk8pk/LjpnlfdqcprboVwnBN3pqFQUZdiWFESBIk3lXqs etiWh5dxCSqOqdIhFJDU0F8gRUusrYoYyr8qhyzfhomo5E+j4+Bss/tjv6ObkKpH27YjfZ/R14P bsKsTJeQXsj0tK6cQW4M62IHQjGJNQK391F6xn+u2TUsz4nODzQTWG3XTDLyIhV+MSkvsN7Njm3 L9VVvI0h0E8PELieH6F//ZvXBU1I5FNIgostCQCojIKTyQs4dOAylAek+PKXDvM3bCJcyhBUXPs 70tYJZb//2rCl8QL37/V/jn5iQPmNtW8+/WuTnNldQkQHfTRMYrTPTzE41GCvTk+Cjy+G6fZrkX QPXlXaPk78/Lk+TuG6faXwIapwLotSnk2wSN+0ddHSUTJOaZLMtkMwWgXW+/GTVYdrAvk= X-Received: by 2002:a17:902:cecd:b0:2c9:9a19:10c with SMTP id d9443c01a7336-2cf34a4c9d7mr151190115ad.40.1784556790807; Mon, 20 Jul 2026 07:13:10 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf34730e35sm57578155ad.64.2026.07.20.07.13.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 07:13:10 -0700 (PDT) From: HyeongJun An To: pratyush@kernel.org, mwalle@kernel.org, tudor.ambarus@linaro.org, miquel.raynal@bootlin.com, richard@nod.at, vigneshr@ti.com Cc: takahiro.kuwano@infineon.com, linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, HyeongJun An Subject: [PATCH v2 2/2] mtd: spi-nor: sfdp: check the length of the SCCR map Date: Mon, 20 Jul 2026 23:11:04 +0900 Message-ID: <20260720141104.2054417-3-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720141104.2054417-1-sammiee5311@gmail.com> References: <20260720141104.2054417-1-sammiee5311@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The spi_nor_parse_sccr() sizes its buffer from the table length the flash reports in the SFDP parameter header. But it then reads DWORD1 and DWORD22 without ever checking the table is that long. So if a flash reports a length of one, the buffer is only four bytes while DWORD22 sits at byte offset 84. With a length of zero kmalloc() returns ZERO_SIZE_PTR rather than an error, so the NULL check doesn't catch it and the first read dereferences it. To fix this, reject a table that's too short for the highest DWORD the parser reads, the way spi_nor_parse_4bait() already does. The table is optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and carries on. The spi_nor_parse_sccr_mc() doesn't need the same check. It works out the number of dice from the length it allocated with, so its highest index stays inside the buffer. Fixes: 7ab8b810757a ("mtd: spi-nor: sfdp: Add support for SCCR map for multi-chip device") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An --- drivers/mtd/spi-nor/sfdp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c index ece8bbd4bc47..98559536d41b 100644 --- a/drivers/mtd/spi-nor/sfdp.c +++ b/drivers/mtd/spi-nor/sfdp.c @@ -1266,6 +1266,7 @@ static int spi_nor_parse_profile1(struct spi_nor *nor, } #define SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE BIT(31) +#define SFDP_SCCR_DWORD_MIN 22 /** * spi_nor_parse_sccr() - Parse the Status, Control and Configuration Register @@ -1284,6 +1285,9 @@ static int spi_nor_parse_sccr(struct spi_nor *nor, size_t len; int ret; + if (sccr_header->length < SFDP_SCCR_DWORD_MIN) + return -EINVAL; + len = sccr_header->length * sizeof(*dwords); dwords = kmalloc(len, GFP_KERNEL); if (!dwords) -- 2.43.0