linux-kernel - [PATCH] mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260122013250.19384-1-ch395@njit.edu>
Date: Wed, 21 Jan 2026 20:32:50 -0500
From: Chenxi Hou <ch395@...t.edu>
To: linux-kernel@...r.kernel.org
Cc: colin.i.king@...il.com,
	linux-mtd@...ts.infradead.org,
	miquel.raynal@...tlin.com,
	richard@....at,
	rk0006818@...il.com,
	vigneshr@...com,
	Chenxi Hou <ch395@...t.edu>,
	Hui Peng <benquike@...il.com>,
	"Zhihao (Zephyr) Yao" <zhihao.yao@...t.edu>
Subject: [PATCH] mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking

UBSAN reports shift-out-of-bounds in jedec_read_mfr() and jedec_read_id():

  UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1924:13
  shift exponent 32 is too large for 32-bit type 'int'
  UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1940:12
  shift exponent 32 is too large for 32-bit type 'int'

The JEDEC manufacturer/device ID masking uses:

  (1 << (cfi->device_type * 8)) - 1

When cfi->device_type is 4, this evaluates to 1 << 32. Since the
literal '1' has type int, this is a 32-bit shift and is undefined behavior.

Fix it by using a 64-bit literal (1ULL) so the shift is performed in a 64-bit type.

Co-developed-by: Hui Peng <benquike@...il.com>
Signed-off-by: Hui Peng <benquike@...il.com>
Co-developed-by: Zhihao (Zephyr) Yao <zhihao.yao@...t.edu>
Signed-off-by: Zhihao (Zephyr) Yao <zhihao.yao@...t.edu>
Signed-off-by: Chenxi Hou <ch395@...t.edu>
---
 drivers/mtd/chips/jedec_probe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index b285962eee2a..3c631608f6d6 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1921,7 +1921,7 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base,
 	 */
 	do {
 		uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi);
-		mask = (1 << (cfi->device_type * 8)) - 1;
+		mask = (1ULL << (cfi->device_type * 8)) - 1;
 		if (ofs >= map->size)
 			return 0;
 		result = map_read(map, base + ofs);
@@ -1937,7 +1937,7 @@ static inline u32 jedec_read_id(struct map_info *map, uint32_t base,
 	map_word result;
 	unsigned long mask;
 	u32 ofs = cfi_build_cmd_addr(1, map, cfi);
-	mask = (1 << (cfi->device_type * 8)) -1;
+	mask = (1ULL << (cfi->device_type * 8)) - 1;
 	result = map_read(map, base + ofs);
 	return result.x[0] & mask;
 }
-- 
2.52.0