mtd: intel-dg: fix array-index-out-of-bounds in intel_dg_mtd_probe()

PATCH In review Gustavo A. R. Silva 5 participants 8 messages Dec 20, 2025 – Jan 9

Subsystems (2)

Memory technology devices (MTD) Intel discrete graphics NVM MTD driver

lore

Share & tools

lore

Gustavo A. R. Silva

author

2025-12-20 06:41 UTC #0 lore raw

PATCH 1/1 mtd: intel-dg: fix array-index-out-of-bounds in intel_dg_mtd_probe()

Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].

from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823

Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15

Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.

Cc [email protected]

Fixes ceb5ab3cb646 ("mtd: add driver for intel graphics non-volatile memory device")

Reported-by Randy Dunlap <[email protected]>

Closes https://lore.kernel.org/linux-hardening/[email protected]/ open here

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 drivers/mtd/devices/mtd_intel_dg.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/mtd/devices/mtd_intel_dg.c +3 -0

index 2bab30dcd35f..d3e89fe324b8 100644
@@ -768,6 +768,9 @@ static int intel_dg_mtd_probe(struct auxiliary_device *aux_dev,
 	if (!nvm)
 		return -ENOMEM;
 
+	/* Update nvm->nregions before first access to nvm->regions[] below. */
+	nvm->nregions = nregions;
+
 	kref_init(&nvm->refcnt);
 	mutex_init(&nvm->lock);

Signature · 1 line

2.43.0

Randy Dunlap

Acked-by on v1 1/1

2025-12-20 07:06 UTC #1 lore raw

Hi,

Quoted 3 lines · Gustavo A. R. Silva

Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].

Yeah, I suspected something like that but didn't find any in-tree documentation about it.

Quoted 5 lines

from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823

Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15

Quoted 8 lines

Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.
Cc [email protected]
Fixes ceb5ab3cb646 ("mtd: add driver for intel graphics non-volatile memory device")
Reported-by Randy Dunlap <[email protected]>
Closes https://lore.kernel.org/linux-hardening/[email protected]/ open here

More appropriately:

Closes https://bugzilla.kernel.org/show_bug.cgi?id=220823

Acked-by Randy Dunlap <[email protected]>

Thanks.

Quoted 19 lines

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 drivers/mtd/devices/mtd_intel_dg.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/mtd/devices/mtd_intel_dg.c +3 -0

index 2bab30dcd35f..d3e89fe324b8 100644
@@ -768,6 +768,9 @@ static int intel_dg_mtd_probe(struct auxiliary_device *aux_dev,
 	if (!nvm)
 		return -ENOMEM;
 
+	/* Update nvm->nregions before first access to nvm->regions[] below. */
+	nvm->nregions = nregions;
+
 	kref_init(&nvm->refcnt);
 	mutex_init(&nvm->lock);

Signature · 1 line

~Randy

Raag Jadav

2025-12-20 07:07 UTC #2 lore raw

In reply to Gustavo A. R. Silva

Quoted 4 lines · Gustavo A. R. Silva

Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].

Quoted 8 lines

from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.

Already fixed[1], but not sure if it's landed yet.

[1] https://lore.kernel.org/linux-mtd/[email protected]/

Raag

Quoted 26 lines

Cc [email protected]
Fixes ceb5ab3cb646 ("mtd: add driver for intel graphics non-volatile memory device")
Reported-by Randy Dunlap <[email protected]>
Closes https://lore.kernel.org/linux-hardening/[email protected]/ open here
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/mtd/devices/mtd_intel_dg.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/mtd/devices/mtd_intel_dg.c +3 -0
index 2bab30dcd35f..d3e89fe324b8 100644
@@ -768,6 +768,9 @@ static int intel_dg_mtd_probe(struct auxiliary_device *aux_dev,
 	if (!nvm)
 		return -ENOMEM;
 
+	/* Update nvm->nregions before first access to nvm->regions[] below. */
+	nvm->nregions = nregions;
+
 	kref_init(&nvm->refcnt);
 	mutex_init(&nvm->lock);
 
Signature · 1 line
2.43.0

Gustavo A. R. Silva

2025-12-20 07:12 UTC #3 lore raw

Quoted 10 lines · Raag Jadav

Quoted 9 lines · Gustavo A. R. Silva
Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].
from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15

Quoted 7 lines

Quoted 3 lines
Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.
Already fixed[1], but not sure if it's landed yet.
[1] https://lore.kernel.org/linux-mtd/[email protected]/

Great! :)

Thanks
-Gustavo

Randy Dunlap

2026-01-07 23:17 UTC #4 lore raw

In reply to Raag Jadav

Hi,

Quoted 10 lines · Raag Jadav

Quoted 9 lines · Gustavo A. R. Silva
Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].
from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15

Quoted 7 lines

Quoted 3 lines
Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.
Already fixed[1], but not sure if it's landed yet.
[1] https://lore.kernel.org/linux-mtd/[email protected]/

What's the status of this patch, please?

Signature · 1 line

~Randy

Raag Jadav

2026-01-09 09:41 UTC #5 lore raw

Quoted 17 lines · Randy Dunlap

Hi,
Quoted 14 lines · Raag Jadav
Quoted 12 lines · Gustavo A. R. Silva
Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].
from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.

Quoted 5 lines

Quoted 3 lines
Already fixed[1], but not sure if it's landed yet.
[1] https://lore.kernel.org/linux-mtd/[email protected]/
What's the status of this patch, please?

I'm assuming it'll go through mtd tree? Miquel?

Raag

Miquel Raynal

maintainer

2026-01-09 13:50 UTC #6 lore raw

Quoted 19 lines · Raag Jadav

Quoted 18 lines · Randy Dunlap
Hi,
Quoted 15 lines · Raag Jadav
Quoted 13 lines · Gustavo A. R. Silva
Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].
from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in
/var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.

Quoted 7 lines

Quoted 5 lines
Quoted 3 lines
Already fixed[1], but not sure if it's landed yet.
[1] https://lore.kernel.org/linux-mtd/[email protected]/
What's the status of this patch, please?
I'm assuming it'll go through mtd tree? Miquel?

It should indeed. However only the mtd list has been included, so it won't appear in "my" todo list. Lucas can you please resend, and use a tool such as b4 to manage the series or at least run get_maintainers.pl?

Thanks,
Miquèl

Raag Jadav

2026-01-09 15:16 UTC #7 lore raw

Quoted 24 lines · Miquel Raynal

Quoted 23 lines · Raag Jadav
Quoted 22 lines · Randy Dunlap
Hi,
Quoted 18 lines · Raag Jadav
Quoted 7 lines · Gustavo A. R. Silva
Fix the UBSAN: array-index-out-of-bounds issue below by updating counter nvm->nregions before the first access to flexible-array member nvm->regions[].
from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Quoted 6 lines
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in
/var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
Notice that this flexible array is annotated with the counted_by() attribute, hence the counter must always be updated before the first access to the array.
Already fixed[1], but not sure if it's landed yet.
[1] https://lore.kernel.org/linux-mtd/[email protected]/

Quoted 7 lines

Quoted 3 lines
Quoted 1 line
What's the status of this patch, please?
I'm assuming it'll go through mtd tree? Miquel?
It should indeed. However only the mtd list has been included, so it won't appear in "my" todo list. Lucas can you please resend, and use a tool such as b4 to manage the series or at least run get_maintainers.pl?

Lucas is no longer with Intel. Sasha, would you be up for it?

Raag