Ivan Stepchenko d31af06865 mtd: lpddr_cmds: fix signed shifts in lpddr_cmds ...

[ Upstream commit c909fec69f84b39e63876c69b9df2c178c6b76ba ]

There are several places where a value of type 'int' is shifted by
lpddr->chipshift. lpddr->chipshift is derived from QINFO geometry and
might reach 31 when QINFO reports a 2 GiB size - the maximum supported by
LPDDR(1) compliant chips. This may cause unexpected sign-extensions when
casting the integer value to the type of 'unsigned long'.

Use '1UL << lpddr->chipshift' and cast 'j' to unsigned long before
shifting so the computation is performed at the destination width.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: c68264711c ("[MTD] LPDDR Command set driver")
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-01-11 15:21:35 +01:00

..

chips

mtd: cfi_cmdset_0001: Byte swap OTP info

2023-11-28 17:20:06 +00:00

devices

mtd: powernv: Add check devm_kasprintf() returned value

2024-10-04 16:29:07 +02:00

hyperbus

mtd: hyperbus: hbmc-am654: fix an OF node reference leak

2025-02-08 09:52:24 +01:00

lpddr

mtd: lpddr_cmds: fix signed shifts in lpddr_cmds

2026-01-11 15:21:35 +01:00

maps

mtd: maps: physmap-core: fix flash size larger than 32-bit

2024-03-26 18:19:52 -04:00

nand

mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors

2026-01-11 15:21:34 +01:00

parsers

mtd: partitions: redboot: Added conversion of operands to a larger type

2024-07-05 09:33:51 +02:00

spi-nor

mtd: spi-nor: Fix spi_nor_try_unlock_all()

2025-08-28 16:28:36 +02:00

tests

mtd: make mtd_test.c a separate module

2024-08-03 08:54:00 +02:00

ubi

ubi: Add a check for ubi_num

2025-02-17 09:40:27 +01:00

ftl.c

mtd: fix possible integer overflow in erase_xfer()

2025-08-15 12:08:51 +02:00

inftlcore.c

mtd: inftlcore: Add error check for inftl_read_oob()

2025-04-25 10:45:29 +02:00

inftlmount.c

mtd: inftl: remove unnecessary oom message

2021-06-11 20:44:21 +02:00

Kconfig

mtdblock: Add comment about UBI block devices

2021-08-06 22:05:13 +02:00

Makefile

mtd: Support kmsg dumper based on pstore/blk

2020-05-31 19:49:01 -07:00

mtd_blkdevs.c

mtd: Fix gluebi NULL pointer dereference caused by ftl notifier

2024-01-25 15:35:15 -08:00

mtdblock_ro.c

mtdblock: make warning messages ratelimited

2023-07-27 17:16:14 +02:00

mtdblock.c

mtdblock: make warning messages ratelimited

2023-07-27 17:16:14 +02:00

mtdchar.c

mtdchar: fix integer overflow in read/write ioctls

2025-12-01 11:41:39 +01:00

mtdconcat.c

mtd: fix repeated word in comment

2022-09-20 10:40:30 +02:00

mtdcore.c

mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()

2024-06-12 11:11:58 +02:00

mtdcore.h

mtd: use refcount to prevent corruption

2023-07-12 13:30:08 +02:00

mtdoops.c

mtd: mtdoops: panic caused mtdoops to call mtdoops_erase function immediately

2022-11-07 17:08:00 +01:00

mtdpart.c

mtd: use refcount to prevent corruption

2023-07-12 13:30:08 +02:00

mtdpstore.c

mtd: Replace kcalloc() with devm_kcalloc()

2025-04-25 10:45:25 +02:00

mtdsuper.c

mtd: key superblock by device number

2023-08-31 12:47:15 +02:00

mtdswap.c

mtd: always initialize 'stats' in struct mtd_oob_ops

2022-09-21 10:38:07 +02:00

nftlcore.c

mtd: always initialize 'stats' in struct mtd_oob_ops

2022-09-21 10:38:07 +02:00

nftlmount.c

mtd: nftl: remove unnecessary oom message

2021-06-11 20:43:26 +02:00

rfd_ftl.c

mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev

2021-08-23 10:01:06 +02:00

sm_ftl.c

mtd: sm_ftl: Fix typos in comments

2023-06-22 23:00:43 +02:00

sm_ftl.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ssfdc.c

mtd: always initialize 'stats' in struct mtd_oob_ops

2022-09-21 10:38:07 +02:00