Skip to content

Commit f399051

Browse files
leitaobroonie
authored andcommitted
spi: tegra210-quad: Avoid shift-out-of-bounds
A shift-out-of-bounds issue was identified by UBSAN in the tegra_qspi_fill_tx_fifo_from_client_txbuf() function. UBSAN: shift-out-of-bounds in drivers/spi/spi-tegra210-quad.c:345:27 shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int') Call trace: tegra_qspi_start_cpu_based_transfer The problem arises when shifting the contents of tx_buf left by 8 times the value of i, which can exceed 4 and result in an exponent larger than 32 bits. Resolve this by restrict the value of i to be less than 4, preventing the shift operation from overflowing. Signed-off-by: Breno Leitao <[email protected]> Fixes: 921fc18 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller") Link: https://patch.msgid.link/[email protected] Signed-off-by: Mark Brown <[email protected]>
1 parent e36eba4 commit f399051

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/spi/spi-tegra210-quad.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,7 @@ tegra_qspi_fill_tx_fifo_from_client_txbuf(struct tegra_qspi *tqspi, struct spi_t
341341
for (count = 0; count < max_n_32bit; count++) {
342342
u32 x = 0;
343343

344-
for (i = 0; len && (i < bytes_per_word); i++, len--)
344+
for (i = 0; len && (i < min(4, bytes_per_word)); i++, len--)
345345
x |= (u32)(*tx_buf++) << (i * 8);
346346
tegra_qspi_writel(tqspi, x, QSPI_TX_FIFO);
347347
}

0 commit comments

Comments
 (0)