From: Chenxi Hou <ch395@njit.edu>
To: linux-kernel@vger.kernel.org
Cc: colin.i.king@gmail.com, linux-mtd@lists.infradead.org,
miquel.raynal@bootlin.com, richard@nod.at, rk0006818@gmail.com,
vigneshr@ti.com, Chenxi Hou <ch395@njit.edu>,
Hui Peng <benquike@gmail.com>,
"Zhihao (Zephyr) Yao" <zhihao.yao@njit.edu>
Subject: [PATCH] mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking
Date: Wed, 21 Jan 2026 20:32:50 -0500 [thread overview]
Message-ID: <20260122013250.19384-1-ch395@njit.edu> (raw)
UBSAN reports shift-out-of-bounds in jedec_read_mfr() and jedec_read_id():
UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1924:13
shift exponent 32 is too large for 32-bit type 'int'
UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1940:12
shift exponent 32 is too large for 32-bit type 'int'
The JEDEC manufacturer/device ID masking uses:
(1 << (cfi->device_type * 8)) - 1
When cfi->device_type is 4, this evaluates to 1 << 32. Since the
literal '1' has type int, this is a 32-bit shift and is undefined behavior.
Fix it by using a 64-bit literal (1ULL) so the shift is performed in a 64-bit type.
Co-developed-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Hui Peng <benquike@gmail.com>
Co-developed-by: Zhihao (Zephyr) Yao <zhihao.yao@njit.edu>
Signed-off-by: Zhihao (Zephyr) Yao <zhihao.yao@njit.edu>
Signed-off-by: Chenxi Hou <ch395@njit.edu>
---
drivers/mtd/chips/jedec_probe.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index b285962eee2a..3c631608f6d6 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1921,7 +1921,7 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base,
*/
do {
uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi);
- mask = (1 << (cfi->device_type * 8)) - 1;
+ mask = (1ULL << (cfi->device_type * 8)) - 1;
if (ofs >= map->size)
return 0;
result = map_read(map, base + ofs);
@@ -1937,7 +1937,7 @@ static inline u32 jedec_read_id(struct map_info *map, uint32_t base,
map_word result;
unsigned long mask;
u32 ofs = cfi_build_cmd_addr(1, map, cfi);
- mask = (1 << (cfi->device_type * 8)) -1;
+ mask = (1ULL << (cfi->device_type * 8)) - 1;
result = map_read(map, base + ofs);
return result.x[0] & mask;
}
--
2.52.0
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
next reply other threads:[~2026-01-22 1:35 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-22 1:32 Chenxi Hou [this message]
2026-01-22 14:08 ` [PATCH] mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking Miquel Raynal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260122013250.19384-1-ch395@njit.edu \
--to=ch395@njit.edu \
--cc=benquike@gmail.com \
--cc=colin.i.king@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=miquel.raynal@bootlin.com \
--cc=richard@nod.at \
--cc=rk0006818@gmail.com \
--cc=vigneshr@ti.com \
--cc=zhihao.yao@njit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox