Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   <Tudor.Ambarus@microchip.com>
To:     <boris.brezillon@bootlin.com>, <marek.vasut@gmail.com>,
        <dwmw2@infradead.org>, <computersforpeace@gmail.com>,
        <richard@nod.at>
CC:     <linux-mtd@lists.infradead.org>, <linux-kernel@vger.kernel.org>,
        <yogeshnarayan.gaur@nxp.com>, <cyrille.pitchen@wedev4u.fr>,
        <Tudor.Ambarus@microchip.com>
Subject: [PATCH 3/7] mtd: spi-nor: add restriction for nmaps in smpt parser
Thread-Topic: [PATCH 3/7] mtd: spi-nor: add restriction for nmaps in smpt
 parser
Thread-Index: AQHUd1My2DY7uJrddEu3eJNAMbNdYw==
Date:   Thu, 8 Nov 2018 11:07:11 +0000
Message-ID: <20181108110653.21063-4-tudor.ambarus@microchip.com>
References: <20181108110653.21063-1-tudor.ambarus@microchip.com>
In-Reply-To: <20181108110653.21063-1-tudor.ambarus@microchip.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [94.177.32.154]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;BN6PR11MB1987;6:8WLJnzha5Nrpw8HTdnFBQs9NYLicrX+vsNfFVbsHCOAMkzdeBrXgbUHQ/piSHFJdmhHzaKGJDTIigbuEhUYnXJbGcotSC/U3QqtaxJcmPLxrKozgsbP77JxFYMV5pUz+YW1yL+52RAj3tJwCPXLsWgQKBQs2myGIaqjz/e09PhlPb+oOscqXctSy7mLN/4NgBaFUmce7wag3QX4ceGl1/mNAlEilUqfb8NRk4G0fmza4HzIOcsdRJXOD8swobBUN++X4n1KLMqwmDj7BsWh//pzbrRRnA18f/WBiXrwyv2ZsndFmKwLsZPxxsl8uYxVPNLWpbfUK3mYDE3oeIH/b36FXYe4c/Gx8U8Ph66SOMjl6aFdKV8uRf3OsKmL/zThSuHBdAl0/8gF49WJrNxtsbklYvfgarXh4I8yZNsOBrGuirwh4haBJ3SNWiSTFbP1wMxcvUzCuoyzBgZZhXYR4pw==;5:buSy0EJ+mM6lhZpLWI2tEdGNQkcKgVoNeIeA1h+x3FO9qE8COER34MibMAzLagNCjXmNzzVvNuxyYZn2iGEL26nokSLASpiLuNijNg0cCTJeW6ErV8kyJ9T3hQHPtRNiVehozkNkNNiYhpEs6LRmDQ33/b7+cplUxnyLC/6ShZQ=;7:EdihGefbBkxcE2ULGY1EFGL0jq1N/RY/ZshDTPFLX/HRskQy6vrhDO2GuHCPEWmZc6yiQNxS5ZZEhEfB8cxTKgLwipsD4teCtGzo74/3bWfLuE+Oxdkdshp4q52TFKmHyk1UZ7yjG+11bFAFCuxswg==
x-ms-office365-filtering-correlation-id: d2709d54-5803-4b9b-24d1-08d6456a5501
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(7020095)(4652040)(8989299)(5600074)(711020)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020);SRVR:BN6PR11MB1987;
x-ms-traffictypediagnostic: BN6PR11MB1987:
x-microsoft-antispam-prvs: <BN6PR11MB1987E94FF66B173115839889F0C50@BN6PR11MB1987.namprd11.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(6040522)(2401047)(8121501046)(5005006)(3231382)(944501410)(52105095)(3002001)(10201501046)(93006095)(93001095)(148016)(149066)(150057)(6041310)(20161123558120)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(201708071742011)(7699051)(76991095);SRVR:BN6PR11MB1987;BCL:0;PCL:0;RULEID:;SRVR:BN6PR11MB1987;
x-forefront-prvs: 0850800A29
x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(136003)(39860400002)(346002)(396003)(366004)(376002)(189003)(199004)(72206003)(8676002)(81166006)(5660300001)(81156014)(102836004)(14454004)(68736007)(305945005)(26005)(86362001)(1076002)(2201001)(39060400002)(7736002)(8936002)(2906002)(2900100001)(36756003)(3846002)(6116002)(71200400001)(71190400001)(107886003)(97736004)(6436002)(6486002)(110136005)(54906003)(2501003)(2616005)(11346002)(446003)(99286004)(53936002)(6512007)(256004)(14444005)(4326008)(478600001)(66066001)(52116002)(386003)(6506007)(186003)(25786009)(316002)(105586002)(76176011)(476003)(486006)(106356001);DIR:OUT;SFP:1101;SCL:1;SRVR:BN6PR11MB1987;H:BN6PR11MB1842.namprd11.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: microchip.com does not designate
 permitted sender hosts)
x-microsoft-antispam-message-info: X7nl3rH4X6z1r7gxpyc5A908BCfVX68IMgKFMQk0zez/SUqt9CRt38Zurp9pjOjrxctwTXpYKd35I5hweKJMNsulZMhmMHmXwDPzU7Q6fXmCL3vGHDnxkVUgG7Tkh2tYUFVbCTR13IEWRngPf6P2ZOrEwmBtoBCX9oNCuQsF4p30qhwrT+/f55QZHXRwg5UZnp1/8c6OWfhsxhR5n48MLdDfX0VGagL5l1JVkQCrk9EOFceRCOJdg+NSeTwwYHBxs7fEV4mL+HZSIsjaa1u9NBs3xiN/agZkBylmgHBvsvScMvnilrK45pFtzLdLHFFj6yS7iyHKwb6Ox4sGbAOFvZmcRIFv4KN+O7imjRUQwWo=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: d2709d54-5803-4b9b-24d1-08d6456a5501
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Nov 2018 11:07:11.7094
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 3f4057f3-b418-4d4e-ba84-d55b4e897d88
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB1987
X-OriginatorOrg: microchip.com
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The map selector is limited to a maximum of 8 bits, allowing
for a maximum of 256 possible map configurations. The total
number of map configurations should be addressable by the
total number of bits described by the detection commands.

For example: if there are five to eight possible sector map
configurations, at least three configuration detection commands
will be needed to extract three bits of configuration selection
information from the device in order to identify which configuration
is currently in use.

Suggested-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
---
 drivers/mtd/spi-nor/spi-nor.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 59dcedb08691..bd1866d714f2 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -2868,7 +2868,7 @@ static const u32 *spi_nor_get_map_in_use(struct spi_n=
or *nor, const u32 *smpt,
 	const u32 *ret =3D NULL;
 	u32 addr;
 	int err;
-	u8 i;
+	u8 i, ncmds, nmaps;
 	u8 addr_width, read_opcode, read_dummy;
 	u8 read_data_mask, data_byte, map_id;
=20
@@ -2877,6 +2877,7 @@ static const u32 *spi_nor_get_map_in_use(struct spi_n=
or *nor, const u32 *smpt,
 	read_opcode =3D nor->read_opcode;
=20
 	map_id =3D 0;
+	ncmds =3D 0;
 	/* Determine if there are any optional Detection Command Descriptors */
 	for (i =3D 0; i < smpt_len; i +=3D 2) {
 		if (smpt[i] & SMPT_DESC_TYPE_MAP)
@@ -2896,6 +2897,7 @@ static const u32 *spi_nor_get_map_in_use(struct spi_n=
or *nor, const u32 *smpt,
 		 * Configuration that is currently in use.
 		 */
 		map_id =3D map_id << 1 | !!(data_byte & read_data_mask);
+		ncmds++;
 	}
=20
 	/*
@@ -2905,7 +2907,16 @@ static const u32 *spi_nor_get_map_in_use(struct spi_=
nor *nor, const u32 *smpt,
 	 *
 	 * Find the matching configuration map.
 	 */
-	while (i < smpt_len) {
+	for (nmaps =3D 0; i < smpt_len; nmaps++) {
+		/*
+		 * The map selector is limited to a maximum of 8 bits, allowing
+		 * for a maximum of 256 possible map configurations. The total
+		 * number of map configurations should be addressable by the
+		 * total number of bits described by the detection commands.
+		 */
+		if (ncmds && nmaps >=3D (1 << (ncmds + 1)))
+			break;
+
 		if (SMPT_MAP_ID(smpt[i]) =3D=3D map_id) {
 			ret =3D smpt + i;
 			break;
--=20
2.9.4