Louis Rannou 61d44a4db2 mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type ... commit f0f0cfdc3a upstream. spi_nor_set_erase_type() was used either to set or to mask out an erase type. When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' The setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as throughout the code just the erase size is considered to determine whether an erase type is supported or not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds. Fixes: 5390a8df76 ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Cc: stable@vger.kernel.org Reported-by: Alexander Stein <Alexander.Stein@tq-group.com> Signed-off-by: Louis Rannou <lrannou@baylibre.com> Tested-by: Alexander Stein <Alexander.Stein@tq-group.com> Link: https://lore.kernel.org/r/20230203070754.50677-1-tudor.ambarus@linaro.org [ta: refine changes, new commit message, fix compilation error] Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-03-10 09:40:05 +01:00
..
chips	mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N	2022-06-09 10:23:25 +02:00
devices	mtd: devices: docg3: check the return value of devm_ioremap() in the probe	2022-10-26 12:35:09 +02:00
hyperbus	mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove	2022-01-27 11:03:15 +01:00
lpddr	mtd: lpddr2_nvm: Fix possible null-ptr-deref	2022-12-31 13:14:10 +01:00
maps	mtd: maps: pxa2xx-flash: fix memory leak in probe	2022-12-31 13:14:12 +01:00
nand	mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe()	2022-11-03 23:59:15 +09:00
parsers	mtd: parsers: bcm47xxpart: Fix halfblock reads	2022-11-10 18:15:32 +01:00
spi-nor	mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type	2023-03-10 09:40:05 +01:00
tests	…
ubi	ubi: ubi_create_volume: Fix use-after-free when volume creation failed	2022-06-14 18:36:10 +02:00
Kconfig	…
Makefile	…
ftl.c	…
inftlcore.c	…
inftlmount.c	…
mtd_blkdevs.c	…
mtdblock.c	mtdblock: warn if opened on NAND	2022-06-09 10:22:49 +02:00
mtdblock_ro.c	…
mtdchar.c	…
mtdconcat.c	…
mtdcore.c	mtd: Fix device name leak when register device failed in add_mtd_device()	2022-12-31 13:14:09 +01:00
mtdcore.h	…
mtdoops.c	…
mtdpart.c	mtd: Fixed breaking list in __mtd_del_partition.	2022-01-27 11:02:48 +01:00
mtdpstore.c	…
mtdsuper.c	…
mtdswap.c	…
nftlcore.c	…
nftlmount.c	…
rfd_ftl.c	…
sm_ftl.c	mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release	2022-08-17 14:23:40 +02:00
sm_ftl.h	…
ssfdc.c	…