]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
spi: tegra210-quad: Avoid shift-out-of-bounds
authorBreno Leitao <leitao@debian.org>
Fri, 4 Oct 2024 12:53:59 +0000 (05:53 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 18:50:49 +0000 (19:50 +0100)
commit5f116d12c0ef33ba3173b70726cc53323d17d9d1
treee2c219eb4965227ea035708792294aec92081f29
parent6a6908aa03c96f05552a261eadd8c17fbb995234
spi: tegra210-quad: Avoid shift-out-of-bounds

[ Upstream commit f399051ec1ff02e74ae5c2517aed2cc486fd005b ]

A shift-out-of-bounds issue was identified by UBSAN in the
tegra_qspi_fill_tx_fifo_from_client_txbuf() function.

 UBSAN: shift-out-of-bounds in drivers/spi/spi-tegra210-quad.c:345:27
 shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
 Call trace:
  tegra_qspi_start_cpu_based_transfer

The problem arises when shifting the contents of tx_buf left by 8 times
the value of i, which can exceed 4 and result in an exponent larger than
32 bits.

Resolve this by restrict the value of i to be less than 4, preventing
the shift operation from overflowing.

Signed-off-by: Breno Leitao <leitao@debian.org>
Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Link: https://patch.msgid.link/20241004125400.1791089-1-leitao@debian.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/spi/spi-tegra210-quad.c