From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pidgin.makrotopia.org (pidgin.makrotopia.org [185.142.180.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A79B1C68F for ; Mon, 13 Apr 2026 10:57:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.142.180.65 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776077843; cv=none; b=qjEYIQZdkqcg3uddqQ7AkgIGQpgZx+rXMJZpXUrsu6623pxEGWy7KE6oAvoLU+WuLAWHD6yO6p4qnUiC4PO7ZC7/PCCnLT79GirbA/meax7JDoL8EcNd9Tk9d+rHVQb6duLI61BK6126FE1/uH0zTjQNE5PfaYOQGsjg2fOav8Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776077843; c=relaxed/simple; bh=t2c5csMYPux9uMIsii4wRwCJhs7pSm/NjxxTUQpQPl8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=inpPSn8MdX89NlaHFCvhCdrbScC70zeQg5K8deE2Q7elXOGeMcvk4LH9VJlWfBx28pfVQzyy2tJLBf6to0o/isMvWCnM+0aQKDZj4y7nY2Rj21MfXfaIKfayGLNKmkRYm5D59r7aE3T6Zjh0IXmAiJ9+ePgwIHY4hvReuHuM9ZE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=makrotopia.org; spf=pass smtp.mailfrom=makrotopia.org; arc=none smtp.client-ip=185.142.180.65 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=makrotopia.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=makrotopia.org Received: from local by pidgin.makrotopia.org with esmtpsa (TLS1.3:TLS_AES_256_GCM_SHA384:256) (Exim 4.99) (envelope-from ) id 1wCEyX-000000000Oa-07Fv; Mon, 13 Apr 2026 10:57:05 +0000 Date: Mon, 13 Apr 2026 11:57:02 +0100 From: Daniel Golle To: Miquel Raynal Cc: Richard Weinberger , Vignesh Raghavendra , Boris Brezillon , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mtd: nand: bbt: clamp GENMASK high bit to word boundary Message-ID: References: <2a62dc1a58f2f8467d95444fa4b37a0af27aeb45.1775951973.git.daniel@makrotopia.org> <871pgjnusl.fsf@bootlin.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <871pgjnusl.fsf@bootlin.com> On Mon, Apr 13, 2026 at 10:12:10AM +0200, Miquel Raynal wrote: > Hi Daniel, > > On 12/04/2026 at 01:05:23 +01, Daniel Golle wrote: > > > When a BBT entry straddles an unsigned long boundary, the GENMASK in > > nanddev_bbt_set_block_status() can potentially overflow because > > offs + bits_per_block - 1 can theoretically exceed BITS_PER_LONG - 1. > > Clamp the high bit so only bits within the current word are masked. > > The cross-word portion is already handled by the pos[1] block below. > > > > Discovered by UBSAN: shift-out-of-bounds in > > drivers/mtd/nand/bbt.c:116:13 > > shift exponent 18446744073709551614 is too large for 64-bit type > > 'long unsigned int' > > How likely is that? It doesn't matter how many bits you use per blocks > (today is 2), it would require a NAND chip that covers an entire country > to reach that number of blocks. If an attacker plays with that value, > does it really matter? Apart from writing out of bounds -which is > physically impossible, we are not talking about virtual memory here- and > get an error later on, I do not see a good reason for this. > > Honestly, I find the final result much less readable than before for no > obvious added value IMO. But maybe I am looking at this the wrong way? It's just the only UBSAN warning I get to see on a recent kernel and my primary goal here was to make the warning go away. Adding an assertion to ensure 'offs' is clamped to will likely also make the warning go away.