{"id":2220288,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2220288/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/patch/20260406-mtk-spi-nor-improvements-v1-5-66f675cbbd3e@baylibre.com/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/1.1/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260406-mtk-spi-nor-improvements-v1-5-66f675cbbd3e@baylibre.com>","date":"2026-04-06T20:13:31","name":"[5/8] spi: mtk-snor: add bounds checking in mtk_snor_cmd_program()","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"0766100e27b8cff7258f2a22071d57de54b044f4","submitter":{"id":87228,"url":"http://patchwork.ozlabs.org/api/1.1/people/87228/?format=json","name":"David Lechner","email":"dlechner@baylibre.com"},"delegate":{"id":161331,"url":"http://patchwork.ozlabs.org/api/1.1/users/161331/?format=json","username":"dlech","first_name":"David","last_name":"Lechner","email":"dlechner@baylibre.com"},"mbox":"http://patchwork.ozlabs.org/project/uboot/patch/20260406-mtk-spi-nor-improvements-v1-5-66f675cbbd3e@baylibre.com/mbox/","series":[{"id":498893,"url":"http://patchwork.ozlabs.org/api/1.1/series/498893/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=498893","date":"2026-04-06T20:13:26","name":"spi: mtk_snor: various fixes and improvements","version":1,"mbox":"http://patchwork.ozlabs.org/series/498893/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2220288/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2220288/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=baylibre-com.20251104.gappssmtp.com\n header.i=@baylibre-com.20251104.gappssmtp.com header.a=rsa-sha256\n header.s=20251104 header.b=N84LYqDI;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=baylibre.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=baylibre-com.20251104.gappssmtp.com\n header.i=@baylibre-com.20251104.gappssmtp.com header.b=\"N84LYqDI\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=baylibre.com","phobos.denx.de;\n spf=pass smtp.mailfrom=dlechner@baylibre.com"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fqLDJ2WN5z1xtJ\n\tfor ; Tue, 07 Apr 2026 06:15:28 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 46F4C84148;\n\tMon, 6 Apr 2026 22:14:53 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id D865283936; Mon, 6 Apr 2026 22:14:47 +0200 (CEST)","from mail-ot1-x32c.google.com (mail-ot1-x32c.google.com\n [IPv6:2607:f8b0:4864:20::32c])\n (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 044F684106\n for ; Mon, 6 Apr 2026 22:14:37 +0200 (CEST)","by mail-ot1-x32c.google.com with SMTP id\n 46e09a7af769-7dbcd92eda5so1652734a34.2\n for ; Mon, 06 Apr 2026 13:14:37 -0700 (PDT)","from [127.0.1.1] ([2600:8803:e7e4:500:90d7:b13f:c53:8ca3])\n by smtp.gmail.com with ESMTPSA id\n 006d021491bc7-68597f6c7bdsm2642044eaf.3.2026.04.06.13.14.35\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Mon, 06 Apr 2026 13:14:36 -0700 (PDT)"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=baylibre-com.20251104.gappssmtp.com; s=20251104; t=1775506476;\n x=1776111276;\n darn=lists.denx.de;\n h=cc:to:in-reply-to:references:message-id:content-transfer-encoding\n :mime-version:subject:date:from:from:to:cc:subject:date:message-id\n :reply-to; bh=wunvxFvyXIkAVH4d1pmR8fyc2psKE9YRFc00IWDE3jw=;\n b=N84LYqDI6FXmNIZD1BHYkLjlxDP8KAzE75QbzP25AmOMLF6BqMXyP0CsofmJ8sLZ/T\n MPFrgKnW9qhFaLGvXW/NSvml9s5FbDBbnH+JLgA4eAxk0bs48FQmZT+SIIrlHarbBOJD\n BvJFzUS5v2lS1tcRh+H8xkIkNoGZPBzrM5SPptOESct48Akq5KlhZkr16LYAZg6bKqB3\n 7L0/LYTJ7aFSpHklsty6iHuQDwg/w/BAxBUCJENmSSVpsGTZu7naHGboDncZSyF26zqa\n oMSeabr0yS97nfpq0yaPoWbGhgpjq4T3uxh1IuV1z07+TLEaTM+TYCnlpuATqk6NILDk\n wwmQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775506476; x=1776111276;\n h=cc:to:in-reply-to:references:message-id:content-transfer-encoding\n :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=wunvxFvyXIkAVH4d1pmR8fyc2psKE9YRFc00IWDE3jw=;\n b=eyEJKM7+FKSm/5A9KYbmbN7ZJ023HJbpvym5WmCbmZOlXU1LeBbiiVqm2/pJJ5ULWH\n 1EUH5rp56UmKrZrNUdO6QRNu/2lfUQY9DJ5d8MWa8Uybe0G7g3mRzdZ0NOySKAYd8Nyb\n mIeYfAsO1hMVIXsu/IzqAsQnVwP7KLbIhHzCA1e+ZzG4vsukipnkJAtFlLF3innRdjOp\n NvvzbBk/n4X7S9qIaQ69f+2uh3e4eBZhErDdytqzSIzkebkXRLkThL4IlA2kLQLvXW49\n seQb36e7vRbTqa+/sAUXgdyoTDmc6VS6iR7e7lhBxDj9yEMsfJfEk7SqxPe4R3H8yfpA\n 9XUw==","X-Forwarded-Encrypted":"i=1;\n AJvYcCUOQc+uep2FE1SRNEcWeNcT0z8o89WuIFesJfTuQEJrVTJKS8vp40i+S52sYW3zW6Gx5LgXwtE=@lists.denx.de","X-Gm-Message-State":"AOJu0Yz9BPHKm0v5xc4w6/yInphPZr90b4fSv1KjcNmEWyWTJK5uTyE3\n xgP/sURM2jnM88uzvmFborvtK+YXXQgq9uxGlpfDQrZqTCKJbu6b9R/PM+u7yMrY8lYFU1DYecv\n Y66TY","X-Gm-Gg":"AeBDietSwPbea5IbZyzXBoJTleoE5q/EtfM7HHkrOwv5isMhYF/frdKsnUQMdJugJ3q\n FI5p+GTYePzM940ME2k+WLWXBMEn12XOn+Pc7zrLMTJLKiMl8DEu7/CyXBmZTuEcKEa4UY709V4\n MeSs12o2ylKBADsF69cghevqcyGPvFZi/ln7C+R6ED4ACtjRiflFJyOTJ9V5+l+HTZ9h3Ubhrvn\n v0nE0TX4tIXEpHER57KUhTUEyAoQndAH6fXYa3mjNLdqVoSM7Z4NGMI6QyI0czjkdCsH5diYTBE\n QMS25xf34nap6m23khH/t4u+ELSg9lqRoAvoFXZ/NHZ7E7u+kaXWj+47yVkK1sqSRWpuZhR66SM\n MDoMyJqyoD7P9c4XhnNnPEs0egmyiowG62SlTBQppZaYsdguS3+hSXNNj6HikWicTUmBy5on6X+\n 8ca72igYghyVYKSIInjpCxD7l74n8=","X-Received":"by 2002:a05:6820:2d08:b0:67d:e0fe:8434 with SMTP id\n 006d021491bc7-6821e8625c6mr7709771eaf.27.1775506476462;\n Mon, 06 Apr 2026 13:14:36 -0700 (PDT)","From":"David Lechner ","Date":"Mon, 06 Apr 2026 15:13:31 -0500","Subject":"[PATCH 5/8] spi: mtk-snor: add bounds checking in\n mtk_snor_cmd_program()","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"7bit","Message-Id":"<20260406-mtk-spi-nor-improvements-v1-5-66f675cbbd3e@baylibre.com>","References":"<20260406-mtk-spi-nor-improvements-v1-0-66f675cbbd3e@baylibre.com>","In-Reply-To":"\n <20260406-mtk-spi-nor-improvements-v1-0-66f675cbbd3e@baylibre.com>","To":"Ryder Lee , Weijie Gao ,\n Chunfeng Yun ,\n Igor Belwon ,\n GSS_MTK_Uboot_upstream ,\n Tom Rini ","Cc":"Julien Stephan , u-boot@lists.denx.de,\n David Lechner , \"Noah.Shen\" ,\n \"Noah.Shen\" ","X-Mailer":"b4 0.16-dev","X-Developer-Signature":"v=1; a=openpgp-sha256; l=1410; i=dlechner@baylibre.com;\n h=from:subject:message-id;\n bh=miK/mxmL+mlMLs31piWOtN7kAAIrkzGe5H/hwQ8fUk0=;\n b=owEBhAF7/pANAwAKAcLMIAH/AY/AAcsmYgBp1BQNURxzHhDDtQXAJjFmvmqJBVB0npL1TT/fh\n zC2zuQAPxCJAUoEAAEKADQWIQTsGNmeYg6D1pzYaJjCzCAB/wGPwAUCadQUDRYcZGxlY2huZXJA\n YmF5bGlicmUuY29tAAoJEMLMIAH/AY/Ar0AIAJkQgxh8BMiW3m/tYDLXZXDRJ88Y0H9npU9c8ol\n awPTXE/+4NPEqLctet4xJnoyjmOeEYqkrIo1SfPADPSIi8ybBGYJtqUKM9H/CPAn8vKvHh7jjxd\n JUIuccMEkRrfMnzwIAa6BcPcAa+Yl9UC1mm1fEtV8YKLdtD3qbCoMo1lPnTeaNLzodw8dK3lFXg\n PN25XsCEkkocPDVvmWHXcGyRYPBUlLxDMooM9RvHhl+2W0pH8XgoNCPHYdqRu0gJqhV/6OpR/l3\n uaUcWmNFnvxJNRHxe70ZOKduQOxmAvRIfxwOUpwl5uLk0yvm+nM5rZ59urMNTuc/siNSQSgVuAh\n 1c2w=","X-Developer-Key":"i=dlechner@baylibre.com; a=openpgp;\n fpr=8A73D82A6A1F509907F373881F8AF88C82F77C03","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"},"content":"From: \"Noah.Shen\" \n\nAdd bounds checking of the various lengths in mtk_snor_cmd_program() to\nprevent reading or writing registers out of bounds.\n\nSigned-off-by: Noah.Shen \nSigned-off-by: David Lechner \n---\n drivers/spi/mtk_snor.c | 11 +++++++++++\n 1 file changed, 11 insertions(+)","diff":"diff --git a/drivers/spi/mtk_snor.c b/drivers/spi/mtk_snor.c\nindex babdb4600d5..77f94827568 100644\n--- a/drivers/spi/mtk_snor.c\n+++ b/drivers/spi/mtk_snor.c\n@@ -90,6 +90,7 @@\n #define MTK_NOR_REG_DMA_END_DADR 0x724\n \n #define MTK_NOR_PRG_MAX_SIZE 6\n+#define MTK_NOR_PRG_CNT_MAX 56\n /* Reading DMA src/dst addresses have to be 16-byte aligned */\n #define MTK_NOR_DMA_ALIGN 16\n #define MTK_NOR_DMA_ALIGN_MASK (MTK_NOR_DMA_ALIGN - 1)\n@@ -405,6 +406,16 @@ static int mtk_snor_cmd_program(struct mtk_snor_priv *priv,\n \tprg_len = op->cmd.nbytes + op->addr.nbytes + op->dummy.nbytes +\n \t\t op->data.nbytes;\n \n+\t/*\n+\t * An invalid op may reach here if the caller calls exec_op without\n+\t * adjust_op_size. return -EINVAL instead of -ENOTSUPP so that\n+\t * spi-mem won't try this op again with generic spi transfers.\n+\t */\n+\tif ((tx_len > MTK_NOR_REG_PRGDATA_MAX + 1) ||\n+\t (rx_len > MTK_NOR_REG_SHIFT_MAX + 1) ||\n+\t (prg_len > MTK_NOR_PRG_CNT_MAX / 8))\n+\t\treturn -EINVAL;\n+\n \t/* fill tx data */\n \n \tfor (i = op->cmd.nbytes; i > 0; i--, reg_offset--) {\n","prefixes":["5/8"]}