Re: [PATCH v2 3/3] fpga: microchip-spi: add bounds checks in mpf_ops_parse_header()

Conor Dooley
2026-04-07T16:43:17Z

[-- Attachment #1: Type: text/plain, Size: 3583 bytes --]

On Tue, Apr 07, 2026 at 08:06:01AM -0600, Sebastian Alba Vives wrote:
> From: Sebastian Josue Alba Vives <sebasjosue84@gmail.com>
>
> mpf_ops_parse_header() reads several fields from the bitstream file
> and uses them as offsets and sizes without validating them against the
> buffer size, leading to multiple out-of-bounds read vulnerabilities:
>
> 1. When header_size (u8 from file) is 0, the expression
> *(buf + header_size - 1) reads one byte before the buffer.
>
> 2. In the block lookup loop, block_id_offset and block_start_offset
> advance by MPF_LOOKUP_TABLE_RECORD_SIZE (9) each iteration with
> blocks_num (u8) controlling the count. With a small buffer, these
> offsets exceed count, causing OOB reads via get_unaligned_le32().
>
> 3. components_size_start (from file) and component_size_byte_num
> (derived from components_num, u16 from file) are used as offsets
> into buf without validation, allowing arbitrary OOB reads.
>
> Add bounds checks for all three cases: reject header_size of 0,
> validate offsets in the block lookup loop, and validate the component
> size read offset.
>
> Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>

Acked-by: Conor Dooley <conor.dooley@microchip.com>

If there's more revisions, please stop sending new versions in response
to old, this is what I see in my mailbox and it is very confusing:

| 1 N Apr 02 Greg KH ( 43) ┌─>Re: [PATCH 2/3] fpga: dfl-afu: fix integer truncation of npages in afu_dma_pin_pages()
| 2 N Apr 04 Greg KH ( 26) │ ┌─>
| 3 N Apr 03 Sebastian Alba ( 55) ├─>[PATCH v2] fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
| 4 N Apr 07 Sebastian Alba ( 41) ├─>[PATCH v3 2/3] fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
| 5 N Apr 02 Sebastian Alba ( 40) ┌─>[PATCH 2/3] fpga: dfl-afu: fix integer truncation of npages in afu_dma_pin_pages()
| 6 NsF Apr 02 To Sebastian Al ( 116) │ ┌─>
| 7 NsF Apr 02 To Sebastian Al ( 107) │ ┌─>Re: [PATCH 3/3] fpga: microchip-spi: add bounds checks in mpf_ops_parse_header()
| 8 N Apr 02 Greg KH ( 106) │ │ ┌─>
| 9 N Apr 02 Greg KH ( 45) │ │ ├─>
| 10 NsF Apr 02 To Sebastian Al ( 104) │ │ ├─>
| 11 N Apr 02 Sebastian Alba ( 76) │ ├─>[PATCH v2] fpga: microchip-spi: add bounds checks in mpf_ops_parse_header()
| 12 N Apr 07 Xu Yilun ( 60) │ │ ┌─>
| 13 N Apr 02 Sebastian Alba ( 105) │ ├─>[PATCH v3] fpga: microchip-spi: add bounds checks in mpf_ops_parse_header()
| 14 N Apr 02 Sebastian Alba ( 65) ├─>[PATCH 3/3] fpga: microchip-spi: add bounds checks in mpf_ops_parse_header()
| 15 N Apr 07 Xu Yilun ( 61) ├─>Re: [PATCH 1/3] fpga: dfl: add bounds check in dfh_get_param_size()
| 16 N Apr 07 Sebastian Alba ( 40) │ ┌─>[PATCH v2 2/3] fpga: dfl-afu: fix integer truncation of npages in afu_dma_pin_pages()
| 17 N Apr 07 Sebastian Alba ( 65) │ ├─>[PATCH v2 3/3] fpga: microchip-spi: add bounds checks in mpf_ops_parse_header()
| 18 N Apr 07 Sebastian Alba ( 41) ├─>[PATCH v2 1/3] fpga: dfl: add bounds check in dfh_get_param_size()
| 19 N Apr 02 Sebastian Alba ( 37) [PATCH 1/3] fpga: dfl: add bounds check in dfh_get_param_size()

If one patch needs changing, you unfortunately need to resubmit the
whole series. If you look here there's multiple v2s of the
microchip-spi patch because of the partial resending.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]