Skip to content
Commit 46a0dc10 authored by Evgeny Novikov's avatar Evgeny Novikov Committed by Miquel Raynal
Browse files

mtd: rawnand: intel: Fix potential buffer overflow in probe



ebu_nand_probe() read the value of u32 variable "cs" from the device
firmware description and used it as the index for array ebu_host->cs
that can contain MAX_CS (2) elements at most. That could result in
a buffer overflow and various bad consequences later.

Fix the potential buffer overflow by restricting values of "cs" with
MAX_CS in probe.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 0b1039f0 ("mtd: rawnand: Add NAND controller support on Intel LGM SoC")
Signed-off-by: default avatarEvgeny Novikov <novikov@ispras.ru>
Co-developed-by: default avatarKirill Shilimanov <kirill.shilimanov@huawei.com>
Signed-off-by: default avatarKirill Shilimanov <kirill.shilimanov@huawei.com>
Co-developed-by: default avatarAnton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: default avatarAnton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210903082653.16441-1-novikov@ispras.ru
parent abac6563
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment