linux-kernel - Re: [PATCH] mtd: intel-dg: fix array-index-out-of-bounds in intel_dg_mtd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aWEb1BF786hX6gmo@black.igk.intel.com>
Date: Fri, 9 Jan 2026 16:16:36 +0100
From: Raag Jadav <raag.jadav@...el.com>
To: Miquel Raynal <miquel.raynal@...tlin.com>
Cc: Randy Dunlap <rdunlap@...radead.org>,
	"Gustavo A. R. Silva" <gustavoars@...nel.org>,
	Alexander Usyskin <alexander.usyskin@...el.com>,
	Richard Weinberger <richard@....at>,
	Vignesh Raghavendra <vigneshr@...com>,
	Rodrigo Vivi <rodrigo.vivi@...el.com>,
	Tomas Winkler <tomasw@...il.com>, linux-mtd@...ts.infradead.org,
	linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH] mtd: intel-dg: fix array-index-out-of-bounds in
 intel_dg_mtd_probe()

On Fri, Jan 09, 2026 at 02:50:18PM +0100, Miquel Raynal wrote:
> On 09/01/2026 at 10:41:08 +01, Raag Jadav <raag.jadav@...el.com> wrote:
> > On Wed, Jan 07, 2026 at 03:17:40PM -0800, Randy Dunlap wrote:
> >> Hi,
> >> 
> >> On 12/19/25 11:07 PM, Raag Jadav wrote:
> >> > On Sat, Dec 20, 2025 at 03:41:49PM +0900, Gustavo A. R. Silva wrote:
> >> >> Fix the UBSAN: array-index-out-of-bounds issue below by updating
> >> >> counter nvm->nregions before the first access to flexible-array
> >> >> member nvm->regions[].
> >> >>
> >> >> from kernel bugzilla:
> >> >> https://bugzilla.kernel.org/show_bug.cgi?id=220823
> >> >>
> >> >> Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in
> >> >> /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
> >> >>
> >> >> Notice that this flexible array is annotated with the counted_by()
> >> >> attribute, hence the counter must always be updated before the
> >> >> first access to the array.
> >> > 
> >> > Already fixed[1], but not sure if it's landed yet.
> >> > 
> >> > [1] https://lore.kernel.org/linux-mtd/20251111-mtd-nregions-v1-1-61db61e78c63@intel.com/
> >> 
> >> What's the status of this patch, please?
> >
> > I'm assuming it'll go through mtd tree? Miquel?
> 
> It should indeed. However only the mtd list has been included, so it
> won't appear in "my" todo list. Lucas can you please resend, and use a
> tool such as b4 to manage the series or at least run get_maintainers.pl?

Lucas is no longer with Intel. Sasha, would you be up for it?

Raag