Sebastian Alba Vives 43a1974da6 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() ... mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL. Fixes: 5f8d4a9008 ("fpga: microchip-spi: add Microchip MPF FPGA manager") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>		2026-06-01 12:29:40 +08:00
..
tests
altera-cvp.c	fpga: altera-cvp: Use pci_find_vsec_capability() when probing FPGA device	2025-11-10 15:03:13 +08:00
altera-fpga2sdram.c
altera-freeze-bridge.c
altera-hps2fpga.c
altera-pr-ip-core-plat.c
altera-pr-ip-core.c
altera-ps-spi.c
dfl-afu-dma-region.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
dfl-afu-error.c
dfl-afu-main.c	fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()	2026-06-01 12:29:13 +08:00
dfl-afu-region.c
dfl-afu.h
dfl-fme-br.c
dfl-fme-error.c
dfl-fme-main.c
dfl-fme-mgr.c
dfl-fme-perf.c
dfl-fme-pr.c
dfl-fme-pr.h
dfl-fme-region.c
dfl-fme.h
dfl-n3000-nios.c
dfl-pci.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
dfl.c	fpga: dfl: add bounds check in dfh_get_param_size()	2026-06-01 12:28:33 +08:00
dfl.h	fpga: dfl: fix typo in header file	2026-01-22 17:08:06 +08:00
efinix-spi.c	fpga-mgr: Add Efinix SPI programming driver	2026-05-04 19:30:18 +08:00
fpga-bridge.c	fpga: bridge: Use sysfs_emit() instead of sprintf()	2026-03-02 17:47:44 +08:00
fpga-mgr.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
fpga-region.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
ice40-spi.c
intel-m10-bmc-sec-update.c	fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit()	2026-03-25 14:57:26 +08:00
Kconfig	fpga-mgr: Add Efinix SPI programming driver	2026-05-04 19:30:18 +08:00
lattice-sysconfig-spi.c	fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()	2026-05-11 23:28:28 +08:00
lattice-sysconfig.c
lattice-sysconfig.h
machxo2-spi.c
Makefile	fpga-mgr: Add Efinix SPI programming driver	2026-05-04 19:30:18 +08:00
microchip-spi.c	fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()	2026-06-01 12:29:40 +08:00
of-fpga-region.c	fpga: region: fix use-after-free in child_regions_with_firmware()	2026-05-04 19:27:05 +08:00
socfpga-a10.c
socfpga.c
stratix10-soc.c
ts73xx-fpga.c	fpga: ts73xx-fpga: add OF match table for device tree probing	2026-05-04 19:28:18 +08:00
versal-fpga.c
xilinx-core.c
xilinx-core.h
xilinx-pr-decoupler.c	fpga: xilinx: Switch Michal Simek's email to new one	2025-12-19 23:40:38 +08:00
xilinx-selectmap.c
xilinx-spi.c	fpga: xilinx-spi: Add missing spi_device_id table	2025-11-10 15:02:07 +08:00
zynq-fpga.c	fpga: xilinx: Switch Michal Simek's email to new one	2025-12-19 23:40:38 +08:00
zynqmp-fpga.c