Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-11 07:24:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

mtd: spi-nor: Fix integer overflow in stacked memories support

Browse source 
The 5d40b3d384 ("mtd: spi-nor: Add parallel and stacked memories support")
adds new SPI bus flags, but also introduces a completely new set of
SPI bus flags in another location. The existing flags field is type
u8, while the new separate flags are BIT(8) and higher. Use of those
new flags triggers integer overflow.

Drop the newly introduced flags which were never used anywhere in the
code. Move the one remaining flag which was used in the correct place
and change it from BIT(8) to BIT(6) so it fits the u8 flags.

Fixes: 5d40b3d384 ("mtd: spi-nor: Add parallel and stacked memories support")
Addresses-Coverity-ID: 510804 Extra high-order bits
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@amd.com>
This commit is contained in:
Marek Vasut 2024-11-03 00:57:31 +01:00 • committed by Tom Rini
parent 9c25cd5631
commit 24b28ffc40
3 changed files with 6 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/spi/zynq_qspi.c
View file

@ -813,7 +813,7 @@ static int zynq_qspi_exec_op(struct spi_slave *slave,
priv->is_parallel = false;
priv->is_stacked = false;
slave->flags &= ~SPI_XFER_MASK;
slave->flags &= ~SPI_XFER_LOWER;
spi_release_bus(slave);
return 0;

6
drivers/spi/zynqmp_gqspi.c
View file

@ -870,8 +870,8 @@ static int zynqmp_qspi_exec_op(struct spi_slave *slave,
priv->bus = 0;
if (priv->is_parallel) {
if (slave->flags & SPI_XFER_MASK)
priv->bus = (slave->flags & SPI_XFER_MASK) >> 8;
if (slave->flags & SPI_XFER_LOWER)
priv->bus = 1;
if (zynqmp_qspi_update_stripe(op))
priv->stripe = 1;
}
@ -890,7 +890,7 @@ static int zynqmp_qspi_exec_op(struct spi_slave *slave,
zynqmp_qspi_chipselect(priv, 0);
priv->is_parallel = false;
slave->flags &= ~SPI_XFER_MASK;
slave->flags &= ~SPI_XFER_LOWER;
return ret;
}

8
include/spi.h
View file

@ -41,12 +41,6 @@
#define SPI_3BYTE_MODE 0x0
#define SPI_4BYTE_MODE 0x1
/* SPI transfer flags */
#define SPI_XFER_STRIPE (1 << 6)
#define SPI_XFER_MASK (3 << 8)
#define SPI_XFER_LOWER (1 << 8)
#define SPI_XFER_UPPER (2 << 8)
/* Max no. of CS supported per spi device */
#define SPI_CS_CNT_MAX 2
@ -169,6 +163,8 @@ struct spi_slave {
#define SPI_XFER_ONCE (SPI_XFER_BEGIN | SPI_XFER_END)
#define SPI_XFER_U_PAGE BIT(4)
#define SPI_XFER_STACKED BIT(5)
#define SPI_XFER_LOWER BIT(6)
/*
* Flag indicating that the spi-controller has multi chip select
* capability and can assert/de-assert more than one chip select