tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking

UBSAN reports shift-out-of-bounds in jedec_read_mfr() and jedec_read_id():

  UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1924:13
  shift exponent 32 is too large for 32-bit type 'int'
  UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1940:12
  shift exponent 32 is too large for 32-bit type 'int'

The JEDEC manufacturer/device ID masking uses:

  (1 << (cfi->device_type * 8)) - 1

When cfi->device_type is 4, this evaluates to 1 << 32. Since the
literal '1' has type int, this is a 32-bit shift and is undefined behavior.

Fix it by using a 64-bit literal (1ULL) so the shift is performed in a 64-bit type.

Co-developed-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Hui Peng <benquike@gmail.com>
Co-developed-by: Zhihao Yao (Zephyr) <zhihao.yao@njit.edu>
Signed-off-by: Zhihao Yao (Zephyr) <zhihao.yao@njit.edu>
Signed-off-by: Chenxi Hou <ch395@njit.edu>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>

authored by

Chenxi Hou and committed by
Miquel Raynal 2b14660c 779c5927

+2 -2
+2 -2
drivers/mtd/chips/jedec_probe.c
··· 1921 1921 */ 1922 1922 do { 1923 1923 uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi); 1924 - mask = (1 << (cfi->device_type * 8)) - 1; 1924 + mask = (1ULL << (cfi->device_type * 8)) - 1; 1925 1925 if (ofs >= map->size) 1926 1926 return 0; 1927 1927 result = map_read(map, base + ofs); ··· 1937 1937 map_word result; 1938 1938 unsigned long mask; 1939 1939 u32 ofs = cfi_build_cmd_addr(1, map, cfi); 1940 - mask = (1 << (cfi->device_type * 8)) -1; 1940 + mask = (1ULL << (cfi->device_type * 8)) - 1; 1941 1941 result = map_read(map, base + ofs); 1942 1942 return result.x[0] & mask; 1943 1943 }