diff options
| author | Breno Leitao <[email protected]> | 2024-10-04 12:53:59 +0000 |
|---|---|---|
| committer | Mark Brown <[email protected]> | 2024-11-01 14:48:52 +0000 |
| commit | f399051ec1ff02e74ae5c2517aed2cc486fd005b (patch) | |
| tree | cb6766c0c31cf201e588e382ef83367a3841a03b /drivers/spi/spi-qcom-qspi.c | |
| parent | spi: axi-spi-engine: Emit trace events for spi transfers (diff) | |
| download | kernel-f399051ec1ff02e74ae5c2517aed2cc486fd005b.tar.gz kernel-f399051ec1ff02e74ae5c2517aed2cc486fd005b.zip | |
spi: tegra210-quad: Avoid shift-out-of-bounds
A shift-out-of-bounds issue was identified by UBSAN in the
tegra_qspi_fill_tx_fifo_from_client_txbuf() function.
UBSAN: shift-out-of-bounds in drivers/spi/spi-tegra210-quad.c:345:27
shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
Call trace:
tegra_qspi_start_cpu_based_transfer
The problem arises when shifting the contents of tx_buf left by 8 times
the value of i, which can exceed 4 and result in an exponent larger than
32 bits.
Resolve this by restrict the value of i to be less than 4, preventing
the shift operation from overflowing.
Signed-off-by: Breno Leitao <[email protected]>
Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Diffstat (limited to 'drivers/spi/spi-qcom-qspi.c')
0 files changed, 0 insertions, 0 deletions