Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2024-12-28 16:53:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

spi: tegra210-quad: Avoid shift-out-of-bounds

Browse Source 
A shift-out-of-bounds issue was identified by UBSAN in the
tegra_qspi_fill_tx_fifo_from_client_txbuf() function.

	 UBSAN: shift-out-of-bounds in drivers/spi/spi-tegra210-quad.c:345:27
	 shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
	 Call trace:
	  tegra_qspi_start_cpu_based_transfer

The problem arises when shifting the contents of tx_buf left by 8 times
the value of i, which can exceed 4 and result in an exponent larger than
32 bits.

Resolve this by restrict the value of i to be less than 4, preventing
the shift operation from overflowing.

Signed-off-by: Breno Leitao <leitao@debian.org>
Fixes: 921fc1838f ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Link: https://patch.msgid.link/20241004125400.1791089-1-leitao@debian.org
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Breno Leitao 2024-10-04 05:53:59 -07:00 committed by Mark Brown
parent e36eba413b
commit f399051ec1
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/spi/spi-tegra210-quad.c
View File

@ -341,7 +341,7 @@ tegra_qspi_fill_tx_fifo_from_client_txbuf(struct tegra_qspi *tqspi, struct spi_t
for (count = 0; count < max_n_32bit; count++) {
u32 x = 0;
for (i = 0; len && (i < bytes_per_word); i++, len--)
for (i = 0; len && (i < min(4, bytes_per_word)); i++, len--)
x |= (u32)(*tx_buf++) << (i * 8);
tegra_qspi_writel(tqspi, x, QSPI_TX_FIFO);
}