[PATCH 1/2] mtd: rawnand: ingenic: validate BCH error index in jz4725b_correct()

[Guanglei Zhu <zhugl3@xiaopeng.com>]

From: Weibin Liu <liuwb@xiaopeng.com>

The JZ4725B BCH controller reports each corrected bit error as an
index into the codeword it was asked to decode, in the INDEX0/INDEX1
fields of the BCH_BHERR registers. These fields are 13 bits wide, but
nothing in jz4725b_correct() checks the reported index against the
size of the data buffer being corrected:

    buf[(bit >> 3)] ^= BIT(bit & 0x7);

With data or ECC coming from an untrusted flash, the decoder can
report an index that points past the end of the data buffer, either
into the parity area of the codeword or beyond it entirely, and the
above statement then flips a bit outside the buffer.

Reject the page with -EBADMSG when the reported index does not fit
in the data area.

Fixes: 3e6ac2ad90b3 ("mtd: rawnand: ingenic: Add support for the JZ4725B")
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
---

Verified with a userspace replica of the correction loop: with
params->size = 512, an index pointing into the parity area (bit =
4099) or at the field maximum (0x1fff) flips bits past the data
buffer (ASAN heap-buffer-overflow); in-range indices keep
correcting as before.

 drivers/mtd/nand/raw/ingenic/jz4725b_bch.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mtd/nand/raw/ingenic/jz4725b_bch.c b/drivers/mtd/nand/raw/ingenic/jz4725b_bch.c
index 2d0e0a2192ae..727f135f381e 100644
--- a/drivers/mtd/nand/raw/ingenic/jz4725b_bch.c
+++ b/drivers/mtd/nand/raw/ingenic/jz4725b_bch.c
@@ -259,6 +259,11 @@ static int jz4725b_correct(struct ingenic_ecc *bch,
 			bit = (reg & BCH_BHERR_INDEX0_MASK) >> BCH_BHERR_INDEX0_SHIFT;
 		}
 
+		if (bit >= params->size * 8) {
+			ret = -EBADMSG;
+			goto out;
+		}
+
 		buf[(bit >> 3)] ^= BIT(bit & 0x7);
 	}
 
-- 
2.50.1