From: William Zhang <william.zhang@broadcom.com>
To: Broadcom Kernel List <bcm-kernel-feedback-list@broadcom.com>,
Linux MTD List <linux-mtd@lists.infradead.org>
Cc: f.fainelli@gmail.com, rafal@milecki.pl, kursad.oney@broadcom.com,
joel.peshkin@broadcom.com, computersforpeace@gmail.com,
anand.gore@broadcom.com, dregan@mail.com,
kamal.dasu@broadcom.com, tomer.yacoby@broadcom.com,
dan.beygelman@broadcom.com,
William Zhang <william.zhang@broadcom.com>,
Florian Fainelli <florian.fainelli@broadcom.com>,
Miquel Raynal <miquel.raynal@bootlin.com>,
linux-kernel@vger.kernel.org,
Vignesh Raghavendra <vigneshr@ti.com>,
Richard Weinberger <richard@nod.at>,
Kamal Dasu <kdasu.kdev@gmail.com>
Subject: [PATCH 04/12] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
Date: Tue, 6 Jun 2023 16:12:44 -0700 [thread overview]
Message-ID: <20230606231252.94838-5-william.zhang@broadcom.com> (raw)
In-Reply-To: <20230606231252.94838-1-william.zhang@broadcom.com>
[-- Attachment #1: Type: text/plain, Size: 1341 bytes --]
When the oob buffer length is not in multiple of words, the oob write
function does out-of-bounds read on the oob source buffer at the last
iteration. Fix that by always checking length limit on the oob buffer
read and fill with 0xff when reaching the end of the buffer to the oob
registers.
Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index 20832857c4aa..d920e88c7f5b 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -1486,10 +1486,10 @@ static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
for (j = 0; j < tbytes; j += 4)
oob_reg_write(ctrl, j,
- (oob[j + 0] << 24) |
- (oob[j + 1] << 16) |
- (oob[j + 2] << 8) |
- (oob[j + 3] << 0));
+ (((j < tbytes) ? oob[j] : 0xff) << 24) |
+ (((j + 1 < tbytes) ? oob[j + 1] : 0xff) << 16) |
+ (((j + 2 < tbytes) ? oob[j + 2] : 0xff) << 8) |
+ ((j + 3 < tbytes) ? oob[j + 3] : 0xff));
return tbytes;
}
--
2.37.3
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4212 bytes --]
next prev parent reply other threads:[~2023-06-06 23:15 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-06 23:12 [PATCH 00/12] mtd: rawnand: brcmnand: driver and doc updates William Zhang
2023-06-06 23:12 ` [PATCH 01/12] mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller William Zhang
2023-06-07 8:06 ` Miquel Raynal
2023-06-06 23:12 ` [PATCH 02/12] mtd: rawnand: brcmnand: Fix potential false time out warning William Zhang
2023-06-06 23:12 ` [PATCH 03/12] mtd: rawnand: brcmnand: Fix crash during the panic_write William Zhang
2023-06-06 23:12 ` William Zhang [this message]
2023-06-07 8:09 ` [PATCH 04/12] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write Miquel Raynal
2023-06-06 23:12 ` [PATCH 05/12] dt-bindings: mtd: brcmnand: Updates for bcmbca SoCs William Zhang
2023-06-07 8:14 ` Miquel Raynal
2023-06-07 20:01 ` William Zhang
2023-06-09 8:58 ` Miquel Raynal
2023-06-09 19:05 ` William Zhang
2023-06-12 17:43 ` Miquel Raynal
2023-06-14 22:46 ` Rob Herring
2023-06-15 0:40 ` William Zhang
2023-06-14 22:43 ` Rob Herring
2023-06-15 0:28 ` William Zhang
2023-06-06 23:12 ` [PATCH 06/12] ARM: dts: broadcom: bcmbca: Add NAND controller node William Zhang
2023-06-06 23:12 ` [PATCH 07/12] arm64: " William Zhang
2023-06-06 23:12 ` [PATCH 08/12] mtd: rawnand: brcmnand: Rename bcm63138 nand driver William Zhang
2023-06-06 23:12 ` [PATCH 09/12] mtd: rawnand: brcmnand: Add new compatible string William Zhang
2023-06-06 23:12 ` [PATCH 10/12] mtd: rawnand: brcmnand: Add BCMBCA read data bus interface William Zhang
2023-06-07 8:20 ` Miquel Raynal
2023-06-07 20:12 ` William Zhang
2023-06-08 6:15 ` Miquel Raynal
2023-06-08 19:04 ` William Zhang
2023-06-07 8:22 ` Miquel Raynal
2023-06-07 20:24 ` William Zhang
2023-06-08 6:18 ` Miquel Raynal
2023-06-08 19:10 ` William Zhang
2023-06-09 8:35 ` Miquel Raynal
2023-06-09 19:16 ` William Zhang
2023-06-12 17:49 ` Miquel Raynal
2023-06-12 17:53 ` Miquel Raynal
2023-06-12 19:18 ` William Zhang
2023-06-13 6:42 ` Miquel Raynal
2023-06-14 0:00 ` William Zhang
2023-06-14 6:22 ` Miquel Raynal
2023-06-14 23:52 ` William Zhang
2023-06-12 19:03 ` William Zhang
2023-06-11 9:54 ` kernel test robot
2023-06-06 23:12 ` [PATCH 11/12] mtd: rawnand: brcmnand: Add support for getting ecc setting from strap William Zhang
2023-06-07 8:25 ` Miquel Raynal
2023-06-06 23:12 ` [PATCH 12/12] mtd: rawnand: brcmnand: Support write protection setting from dts William Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230606231252.94838-5-william.zhang@broadcom.com \
--to=william.zhang@broadcom.com \
--cc=anand.gore@broadcom.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=computersforpeace@gmail.com \
--cc=dan.beygelman@broadcom.com \
--cc=dregan@mail.com \
--cc=f.fainelli@gmail.com \
--cc=florian.fainelli@broadcom.com \
--cc=joel.peshkin@broadcom.com \
--cc=kamal.dasu@broadcom.com \
--cc=kdasu.kdev@gmail.com \
--cc=kursad.oney@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=miquel.raynal@bootlin.com \
--cc=rafal@milecki.pl \
--cc=richard@nod.at \
--cc=tomer.yacoby@broadcom.com \
--cc=vigneshr@ti.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).