Sebastian Alba Vives 43a1974da6 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() ...

mpf_ops_parse_header() reads header_size from the bitstream at
MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression
*(buf + header_size - 1) reads one byte before the buffer start.

Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core
guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET.
The only real gap is the zero header_size case, which cannot be
resolved by providing a larger buffer, so return -EINVAL.

Fixes: 5f8d4a9008 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
Cc: [email protected]
Signed-off-by: Sebastian Alba Vives <[email protected]>
Reviewed-by: Xu Yilun <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Xu Yilun <[email protected]>

2026-06-01 12:29:40 +08:00

..

tests

Merge tag 'fpga-for-6.16-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next

2025-05-21 14:08:44 +02:00

altera-cvp.c

fpga: altera-cvp: Use pci_find_vsec_capability() when probing FPGA device

2025-11-10 15:03:13 +08:00

altera-fpga2sdram.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

altera-freeze-bridge.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

altera-hps2fpga.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

altera-pr-ip-core-plat.c

…

altera-pr-ip-core.c

…

altera-ps-spi.c

…

dfl-afu-dma-region.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dfl-afu-error.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-afu-main.c

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

2026-06-01 12:29:13 +08:00

dfl-afu-region.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-afu.h

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-br.c

fpga: dfl: drop unneeded get_device() and put_device() of feature device

2024-12-18 22:28:48 +08:00

dfl-fme-error.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-main.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-mgr.c

…

dfl-fme-perf.c

…

dfl-fme-pr.c

fpga: dfl: refactor internal DFL APIs to take/return feature device data

2024-12-18 22:28:48 +08:00

dfl-fme-pr.h

…

dfl-fme-region.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

dfl-fme.h

…

dfl-n3000-nios.c

…

dfl-pci.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dfl.c

fpga: dfl: add bounds check in dfh_get_param_size()

2026-06-01 12:28:33 +08:00

dfl.h

fpga: dfl: fix typo in header file

2026-01-22 17:08:06 +08:00

efinix-spi.c

fpga-mgr: Add Efinix SPI programming driver

2026-05-04 19:30:18 +08:00

fpga-bridge.c

fpga: bridge: Use sysfs_emit() instead of sprintf()

2026-03-02 17:47:44 +08:00

fpga-mgr.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fpga-region.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ice40-spi.c

…

intel-m10-bmc-sec-update.c

fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit()

2026-03-25 14:57:26 +08:00

Kconfig

fpga-mgr: Add Efinix SPI programming driver

2026-05-04 19:30:18 +08:00

lattice-sysconfig-spi.c

fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()

2026-05-11 23:28:28 +08:00

lattice-sysconfig.c

…

lattice-sysconfig.h

…

machxo2-spi.c

…

Makefile

fpga-mgr: Add Efinix SPI programming driver

2026-05-04 19:30:18 +08:00

microchip-spi.c

fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

2026-06-01 12:29:40 +08:00

of-fpga-region.c

fpga: region: fix use-after-free in child_regions_with_firmware()

2026-05-04 19:27:05 +08:00

socfpga-a10.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

socfpga.c

fpga: socfpga: Rename 'timeout' variable as 'time_left'

2024-08-14 23:57:07 +08:00

stratix10-soc.c

fpga: Switch back to struct platform_driver::remove()

2024-11-11 10:43:21 +08:00

ts73xx-fpga.c

fpga: ts73xx-fpga: add OF match table for device tree probing

2026-05-04 19:28:18 +08:00

versal-fpga.c

fpga: versal: remove incorrect of_match_ptr annotation

2025-03-01 17:37:31 +08:00

xilinx-core.c

…

xilinx-core.h

…

xilinx-pr-decoupler.c

fpga: xilinx: Switch Michal Simek's email to new one

2025-12-19 23:40:38 +08:00

xilinx-selectmap.c

…

xilinx-spi.c

fpga: xilinx-spi: Add missing spi_device_id table

2025-11-10 15:02:07 +08:00

zynq-fpga.c

fpga: xilinx: Switch Michal Simek's email to new one

2025-12-19 23:40:38 +08:00

zynqmp-fpga.c

…