diff options
| author | Noah.Shen <[email protected]> | 2026-04-06 15:13:31 -0500 |
|---|---|---|
| committer | David Lechner <[email protected]> | 2026-04-28 13:11:19 -0500 |
| commit | 78950bb20707417657d9122d50325bda9c9aa8b9 (patch) | |
| tree | 5f52bc1087244be0bfc1d050258aba0418a4f176 | |
| parent | 55944a68d550d00df494a5c75685f00cbf0998f0 (diff) | |
spi: mtk-snor: add bounds checking in mtk_snor_cmd_program()
Add bounds checking of the various lengths in mtk_snor_cmd_program() to
prevent reading or writing registers out of bounds.
Signed-off-by: Noah.Shen <[email protected]>
Reviewed-by: Julien Stephan <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: David Lechner <[email protected]>
| -rw-r--r-- | drivers/spi/mtk_snor.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/drivers/spi/mtk_snor.c b/drivers/spi/mtk_snor.c index babdb4600d5..77f94827568 100644 --- a/drivers/spi/mtk_snor.c +++ b/drivers/spi/mtk_snor.c @@ -90,6 +90,7 @@ #define MTK_NOR_REG_DMA_END_DADR 0x724 #define MTK_NOR_PRG_MAX_SIZE 6 +#define MTK_NOR_PRG_CNT_MAX 56 /* Reading DMA src/dst addresses have to be 16-byte aligned */ #define MTK_NOR_DMA_ALIGN 16 #define MTK_NOR_DMA_ALIGN_MASK (MTK_NOR_DMA_ALIGN - 1) @@ -405,6 +406,16 @@ static int mtk_snor_cmd_program(struct mtk_snor_priv *priv, prg_len = op->cmd.nbytes + op->addr.nbytes + op->dummy.nbytes + op->data.nbytes; + /* + * An invalid op may reach here if the caller calls exec_op without + * adjust_op_size. return -EINVAL instead of -ENOTSUPP so that + * spi-mem won't try this op again with generic spi transfers. + */ + if ((tx_len > MTK_NOR_REG_PRGDATA_MAX + 1) || + (rx_len > MTK_NOR_REG_SHIFT_MAX + 1) || + (prg_len > MTK_NOR_PRG_CNT_MAX / 8)) + return -EINVAL; + /* fill tx data */ for (i = op->cmd.nbytes; i > 0; i--, reg_offset--) { |