Ivan Stepchenko a508da16fe mtd: fix possible integer overflow in erase_xfer() ...

[ Upstream commit 9358bdb9f9 ]

The expression '1 << EraseUnitSize' is evaluated in int, which causes
a negative result when shifting by 31 - the upper bound of the valid
range [10, 31], enforced by scan_header(). This leads to incorrect
extension when storing the result in 'erase->len' (uint64_t), producing
a large unexpected value.

Found by Linux Verification Center (linuxtesting.org) with Svace.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-08-15 12:13:49 +02:00

..

chips

…

devices

…

hyperbus

…

lpddr

…

maps

…

nand

mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()

2025-08-01 09:48:45 +01:00

parsers

…

spi-nor

…

tests

…

ubi

…

ftl.c

mtd: fix possible integer overflow in erase_xfer()

2025-08-15 12:13:49 +02:00

inftlcore.c

mtd: inftlcore: Add error check for inftl_read_oob()

2025-04-20 10:15:45 +02:00

inftlmount.c

…

Kconfig

…

Makefile

…

mtd_blkdevs.c

…

mtdblock_ro.c

…

mtdblock.c

…

mtdchar.c

…

mtdconcat.c

…

mtdcore.c

…

mtdcore.h

…

mtdoops.c

…

mtdpart.c

…

mtdpstore.c

mtd: Replace kcalloc() with devm_kcalloc()

2025-04-20 10:15:39 +02:00

mtdsuper.c

…

mtdswap.c

…

nftlcore.c

…

nftlmount.c

…

rfd_ftl.c

…

sm_ftl.c

…

sm_ftl.h

…

ssfdc.c

…