mirror of https://github.com/torvalds/linux.git
2a8787c1cd
Change the memcpy length to fix the out-of-bounds issue when writing the
data that is not 4 byte aligned to TX FIFO.
To reproduce the issue, write 3 bytes data to NOR chip.
dd if=3b of=/dev/mtd0
[ 36.926103] ==================================================================
[ 36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838
[ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455
[ 36.946721]
[ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070
[ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT)
[ 36.961260] Call trace:
[ 36.963723] dump_backtrace+0x90/0xe8
[ 36.967414] show_stack+0x18/0x24
[ 36.970749] dump_stack_lvl+0x78/0x90
[ 36.974451] print_report+0x114/0x5cc
[ 36.978151] kasan_report+0xa4/0xf0
[ 36.981670] __asan_report_load_n_noabort+0x1c/0x28
[ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838
[ 36.990800] spi_mem_exec_op+0x8ec/0xd30
[ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0
[ 36.999323] spi_mem_dirmap_write+0x238/0x32c
[ 37.003710] spi_nor_write_data+0x220/0x374
[ 37.007932] spi_nor_write+0x110/0x2e8
[ 37.011711] mtd_write_oob_std+0x154/0x1f0
[ 37.015838] mtd_write_oob+0x104/0x1d0
[ 37.019617] mtd_write+0xb8/0x12c
[ 37.022953] mtdchar_write+0x224/0x47c
[ 37.026732] vfs_write+0x1e4/0x8c8
[ 37.030163] ksys_write+0xec/0x1d0
[ 37.033586] __arm64_sys_write+0x6c/0x9c
[ 37.037539] invoke_syscall+0x6c/0x258
[ 37.041327] el0_svc_common.constprop.0+0x160/0x22c
[ 37.046244] do_el0_svc+0x44/0x5c
[ 37.049589] el0_svc+0x38/0x78
[ 37.052681] el0t_64_sync_handler+0x13c/0x158
[ 37.057077] el0t_64_sync+0x190/0x194
[ 37.060775]
[ 37.062274] Allocated by task 455:
[ 37.065701] kasan_save_stack+0x2c/0x54
[ 37.069570] kasan_save_track+0x20/0x3c
[ 37.073438] kasan_save_alloc_info+0x40/0x54
[ 37.077736] __kasan_kmalloc+0xa0/0xb8
[ 37.081515] __kmalloc_noprof+0x158/0x2f8
[ 37.085563] mtd_kmalloc_up_to+0x120/0x154
[ 37.089690] mtdchar_write+0x130/0x47c
[ 37.093469] vfs_write+0x1e4/0x8c8
[ 37.096901] ksys_write+0xec/0x1d0
[ 37.100332] __arm64_sys_write+0x6c/0x9c
[ 37.104287] invoke_syscall+0x6c/0x258
[ 37.108064] el0_svc_common.constprop.0+0x160/0x22c
[ 37.112972] do_el0_svc+0x44/0x5c
[ 37.116319] el0_svc+0x38/0x78
[ 37.119401] el0t_64_sync_handler+0x13c/0x158
[ 37.123788] el0t_64_sync+0x190/0x194
[ 37.127474]
[ 37.128977] The buggy address belongs to the object at ffff00081037c2a0
[ 37.128977] which belongs to the cache kmalloc-8 of size 8
[ 37.141177] The buggy address is located 0 bytes inside of
[ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3)
[ 37.153465]
[ 37.154971] The buggy address belongs to the physical page:
[ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c
[ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[ 37.175149] page_type: 0xfdffffff(slab)
[ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000
[ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000
[ 37.194553] page dumped because: kasan: bad access detected
[ 37.200144]
[ 37.201647] Memory state around the buggy address:
[ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc
[ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc
[ 37.228186] ^
[ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 37.246962] ==================================================================
[ 37.254394] Disabling lock debugging due to kernel taint
0+1 records in
0+1 records out
3 bytes copied, 0.335911 s, 0.0 kB/s
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| atmel-quadspi.c | ||
| internals.h | ||
| spi-airoha-snfi.c | ||
| spi-altera-core.c | ||
| spi-altera-dfl.c | ||
| spi-altera-platform.c | ||
| spi-amd.c | ||
| spi-amlogic-spifc-a1.c | ||
| spi-ar934x.c | ||
| spi-armada-3700.c | ||
| spi-aspeed-smc.c | ||
| spi-at91-usart.c | ||
| spi-ath79.c | ||
| spi-atmel.c | ||
| spi-au1550.c | ||
| spi-axi-spi-engine.c | ||
| spi-bcm-qspi.c | ||
| spi-bcm-qspi.h | ||
| spi-bcm63xx-hsspi.c | ||
| spi-bcm63xx.c | ||
| spi-bcm2835.c | ||
| spi-bcm2835aux.c | ||
| spi-bcmbca-hsspi.c | ||
| spi-bitbang-txrx.h | ||
| spi-bitbang.c | ||
| spi-brcmstb-qspi.c | ||
| spi-butterfly.c | ||
| spi-cadence-quadspi.c | ||
| spi-cadence-xspi.c | ||
| spi-cadence.c | ||
| spi-cavium-octeon.c | ||
| spi-cavium-thunderx.c | ||
| spi-cavium.c | ||
| spi-cavium.h | ||
| spi-ch341.c | ||
| spi-clps711x.c | ||
| spi-coldfire-qspi.c | ||
| spi-cs42l43.c | ||
| spi-davinci.c | ||
| spi-dln2.c | ||
| spi-dw-bt1.c | ||
| spi-dw-core.c | ||
| spi-dw-dma.c | ||
| spi-dw-mmio.c | ||
| spi-dw-pci.c | ||
| spi-dw.h | ||
| spi-ep93xx.c | ||
| spi-falcon.c | ||
| spi-fsi.c | ||
| spi-fsl-cpm.c | ||
| spi-fsl-cpm.h | ||
| spi-fsl-dspi.c | ||
| spi-fsl-espi.c | ||
| spi-fsl-lib.c | ||
| spi-fsl-lib.h | ||
| spi-fsl-lpspi.c | ||
| spi-fsl-qspi.c | ||
| spi-fsl-spi.c | ||
| spi-fsl-spi.h | ||
| spi-geni-qcom.c | ||
| spi-gpio.c | ||
| spi-gxp.c | ||
| spi-hisi-kunpeng.c | ||
| spi-hisi-sfc-v3xx.c | ||
| spi-img-spfi.c | ||
| spi-imx.c | ||
| spi-ingenic.c | ||
| spi-intel-pci.c | ||
| spi-intel-platform.c | ||
| spi-intel.c | ||
| spi-intel.h | ||
| spi-iproc-qspi.c | ||
| spi-jcore.c | ||
| spi-lantiq-ssc.c | ||
| spi-ljca.c | ||
| spi-lm70llp.c | ||
| spi-loongson-core.c | ||
| spi-loongson-pci.c | ||
| spi-loongson-plat.c | ||
| spi-loongson.h | ||
| spi-loopback-test.c | ||
| spi-lp8841-rtc.c | ||
| spi-mem.c | ||
| spi-meson-spicc.c | ||
| spi-meson-spifc.c | ||
| spi-microchip-core-qspi.c | ||
| spi-microchip-core.c | ||
| spi-mpc52xx-psc.c | ||
| spi-mpc52xx.c | ||
| spi-mpc512x-psc.c | ||
| spi-mt65xx.c | ||
| spi-mt7621.c | ||
| spi-mtk-nor.c | ||
| spi-mtk-snfi.c | ||
| spi-mux.c | ||
| spi-mxic.c | ||
| spi-mxs.c | ||
| spi-npcm-fiu.c | ||
| spi-npcm-pspi.c | ||
| spi-nxp-fspi.c | ||
| spi-oc-tiny.c | ||
| spi-omap-uwire.c | ||
| spi-omap2-mcspi.c | ||
| spi-orion.c | ||
| spi-pci1xxxx.c | ||
| spi-pic32-sqi.c | ||
| spi-pic32.c | ||
| spi-pl022.c | ||
| spi-ppc4xx.c | ||
| spi-pxa2xx-dma.c | ||
| spi-pxa2xx-pci.c | ||
| spi-pxa2xx-platform.c | ||
| spi-pxa2xx.c | ||
| spi-pxa2xx.h | ||
| spi-qcom-qspi.c | ||
| spi-qup.c | ||
| spi-rb4xx.c | ||
| spi-realtek-rtl.c | ||
| spi-rockchip-sfc.c | ||
| spi-rockchip.c | ||
| spi-rpc-if.c | ||
| spi-rspi.c | ||
| spi-rzv2m-csi.c | ||
| spi-s3c64xx.c | ||
| spi-sc18is602.c | ||
| spi-sh-hspi.c | ||
| spi-sh-msiof.c | ||
| spi-sh-sci.c | ||
| spi-sh.c | ||
| spi-sifive.c | ||
| spi-slave-mt27xx.c | ||
| spi-slave-system-control.c | ||
| spi-slave-time.c | ||
| spi-sn-f-ospi.c | ||
| spi-sprd-adi.c | ||
| spi-sprd.c | ||
| spi-st-ssc4.c | ||
| spi-stm32-qspi.c | ||
| spi-stm32.c | ||
| spi-sun4i.c | ||
| spi-sun6i.c | ||
| spi-sunplus-sp7021.c | ||
| spi-synquacer.c | ||
| spi-tegra20-sflash.c | ||
| spi-tegra20-slink.c | ||
| spi-tegra114.c | ||
| spi-tegra210-quad.c | ||
| spi-test.h | ||
| spi-ti-qspi.c | ||
| spi-tle62x0.c | ||
| spi-topcliff-pch.c | ||
| spi-uniphier.c | ||
| spi-wpcm-fiu.c | ||
| spi-xcomm.c | ||
| spi-xilinx.c | ||
| spi-xlp.c | ||
| spi-xtensa-xtfpga.c | ||
| spi-zynq-qspi.c | ||
| spi-zynqmp-gqspi.c | ||
| spi.c | ||
| spidev.c | ||