From 24b28ffc40d464696b909ca5a4e860e09343397b Mon Sep 17 00:00:00 2001 From: Marek Vasut Date: Sun, 3 Nov 2024 00:57:31 +0100 Subject: mtd: spi-nor: Fix integer overflow in stacked memories support The 5d40b3d384dc ("mtd: spi-nor: Add parallel and stacked memories support") adds new SPI bus flags, but also introduces a completely new set of SPI bus flags in another location. The existing flags field is type u8, while the new separate flags are BIT(8) and higher. Use of those new flags triggers integer overflow. Drop the newly introduced flags which were never used anywhere in the code. Move the one remaining flag which was used in the correct place and change it from BIT(8) to BIT(6) so it fits the u8 flags. Fixes: 5d40b3d384dc ("mtd: spi-nor: Add parallel and stacked memories support") Addresses-Coverity-ID: 510804 Extra high-order bits Reported-by: Heinrich Schuchardt Signed-off-by: Marek Vasut Reviewed-by: Venkatesh Yadav Abbarapu --- drivers/spi/zynq_qspi.c | 2 +- drivers/spi/zynqmp_gqspi.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers') diff --git a/drivers/spi/zynq_qspi.c b/drivers/spi/zynq_qspi.c index 4aad3248d9e..e43dbb40c4a 100644 --- a/drivers/spi/zynq_qspi.c +++ b/drivers/spi/zynq_qspi.c @@ -813,7 +813,7 @@ static int zynq_qspi_exec_op(struct spi_slave *slave, priv->is_parallel = false; priv->is_stacked = false; - slave->flags &= ~SPI_XFER_MASK; + slave->flags &= ~SPI_XFER_LOWER; spi_release_bus(slave); return 0; diff --git a/drivers/spi/zynqmp_gqspi.c b/drivers/spi/zynqmp_gqspi.c index 1d19b2606c5..4251bf28cd3 100644 --- a/drivers/spi/zynqmp_gqspi.c +++ b/drivers/spi/zynqmp_gqspi.c @@ -870,8 +870,8 @@ static int zynqmp_qspi_exec_op(struct spi_slave *slave, priv->bus = 0; if (priv->is_parallel) { - if (slave->flags & SPI_XFER_MASK) - priv->bus = (slave->flags & SPI_XFER_MASK) >> 8; + if (slave->flags & SPI_XFER_LOWER) + priv->bus = 1; if (zynqmp_qspi_update_stripe(op)) priv->stripe = 1; } @@ -890,7 +890,7 @@ static int zynqmp_qspi_exec_op(struct spi_slave *slave, zynqmp_qspi_chipselect(priv, 0); priv->is_parallel = false; - slave->flags &= ~SPI_XFER_MASK; + slave->flags &= ~SPI_XFER_LOWER; return ret; } -- cgit v1.3.1