Sebastian Alba Vives 43a1974da6 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() ...

mpf_ops_parse_header() reads header_size from the bitstream at
MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression
*(buf + header_size - 1) reads one byte before the buffer start.

Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core
guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET.
The only real gap is the zero header_size case, which cannot be
resolved by providing a larger buffer, so return -EINVAL.

Fixes: 5f8d4a9008 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>

2026-06-01 12:29:40 +08:00

..

tests

Merge tag 'fpga-for-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next

2025-05-21 14:08:44 +02:00

altera-cvp.c

fpga: altera-cvp: Use pci_find_vsec_capability() when probing FPGA device

2025-11-10 15:03:13 +08:00

altera-fpga2sdram.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

altera-freeze-bridge.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

altera-hps2fpga.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

altera-pr-ip-core-plat.c

fpga: Explicitly include correct DT includes

2023-07-17 09:23:04 +08:00

altera-pr-ip-core.c

fpga: altera-pr-ip: fix unsigned comparison with less than zero

2022-06-10 15:48:23 +08:00

altera-ps-spi.c

fpga: altera: drop driver owner assignment

2024-04-01 16:39:57 +08:00

dfl-afu-dma-region.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dfl-afu-error.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-afu-main.c

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

2026-06-01 12:29:13 +08:00

dfl-afu-region.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-afu.h

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-br.c

fpga: dfl: drop unneeded get_device() and put_device() of feature device

2024-12-18 22:28:48 +08:00

dfl-fme-error.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-main.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-mgr.c

fpga: dfl-fme-mgr: Convert to devm_platform_ioremap_resource()

2023-07-10 16:41:44 +08:00

dfl-fme-perf.c

fpga: dfl: more kernel-doc corrections

2023-01-28 23:33:43 +08:00

dfl-fme-pr.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-pr.h

fpga: dfl: more kernel-doc corrections

2023-01-28 23:33:43 +08:00

dfl-fme-region.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

dfl-fme.h

fpga: dfl: remove unused member pdata from struct dfl_{afu,fme}

2024-04-23 15:36:33 +08:00

dfl-n3000-nios.c

fpga: fix spelling mistakes

2021-07-21 19:54:21 -07:00

dfl-pci.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dfl.c

fpga: dfl: add bounds check in dfh_get_param_size()

2026-06-01 12:28:33 +08:00

dfl.h

fpga: dfl: fix typo in header file

2026-01-22 17:08:06 +08:00

efinix-spi.c

fpga-mgr: Add Efinix SPI programming driver

2026-05-04 19:30:18 +08:00

fpga-bridge.c

fpga: bridge: Use sysfs_emit() instead of sprintf()

2026-03-02 17:47:44 +08:00

fpga-mgr.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fpga-region.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ice40-spi.c

fpga: ice40-spi: Don't use "proxy" headers

2024-04-23 15:36:32 +08:00

intel-m10-bmc-sec-update.c

fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit()

2026-03-25 14:57:26 +08:00

Kconfig

fpga-mgr: Add Efinix SPI programming driver

2026-05-04 19:30:18 +08:00

lattice-sysconfig-spi.c

fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()

2026-05-11 23:28:28 +08:00

lattice-sysconfig.c

fpga: lattice-sysconfig-spi: add Lattice sysCONFIG FPGA manager

2022-10-25 14:44:03 +08:00

lattice-sysconfig.h

fpga: lattice-sysconfig-spi: add Lattice sysCONFIG FPGA manager

2022-10-25 14:44:03 +08:00

machxo2-spi.c

fpga: mgr: Use standard dev_release for class driver

2021-11-28 13:59:13 -08:00

Makefile

fpga-mgr: Add Efinix SPI programming driver

2026-05-04 19:30:18 +08:00

microchip-spi.c

fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

2026-06-01 12:29:40 +08:00

of-fpga-region.c

fpga: region: fix use-after-free in child_regions_with_firmware()

2026-05-04 19:27:05 +08:00

socfpga-a10.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

socfpga.c

fpga: socfpga: Rename 'timeout' variable as 'time_left'

2024-08-14 23:57:07 +08:00

stratix10-soc.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

ts73xx-fpga.c

fpga: ts73xx-fpga: add OF match table for device tree probing

2026-05-04 19:28:18 +08:00

versal-fpga.c

fpga: versal: remove incorrect of_match_ptr annotation

2025-03-01 17:37:31 +08:00

xilinx-core.c

fpga: xilinx-core: add new gpio names for prog and init

2024-03-31 22:48:13 +08:00

xilinx-core.h

fpga: xilinx-spi: extract a common driver core

2024-03-31 22:41:26 +08:00

xilinx-pr-decoupler.c

fpga: xilinx: Switch Michal Simek's email to new one

2025-12-19 23:40:38 +08:00

xilinx-selectmap.c

fpga: xilinx-selectmap: add new driver

2024-03-31 22:44:21 +08:00

xilinx-spi.c

fpga: xilinx-spi: Add missing spi_device_id table

2025-11-10 15:02:07 +08:00

zynq-fpga.c

fpga: xilinx: Switch Michal Simek's email to new one

2025-12-19 23:40:38 +08:00

zynqmp-fpga.c

fpga: zynqmp-fpga: Adds status interface

2023-03-09 17:33:19 +01:00