Sebastian Alba Vives 43a1974da6 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() ... mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL. Fixes: 5f8d4a9008 ("fpga: microchip-spi: add Microchip MPF FPGA manager") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>		2026-06-01 12:29:40 +08:00
..
tests	FPGA Manager changes for 6.16-rc1	2025-05-21 14:08:44 +02:00
altera-cvp.c	fpga: altera-cvp: Use pci_find_vsec_capability() when probing FPGA device	2025-11-10 15:03:13 +08:00
altera-fpga2sdram.c	fpga: Switch back to struct platform_driver::remove()	2024-11-11 10:43:21 +08:00
altera-freeze-bridge.c	fpga: Switch back to struct platform_driver::remove()	2024-11-11 10:43:21 +08:00
altera-hps2fpga.c	fpga: Switch back to struct platform_driver::remove()	2024-11-11 10:43:21 +08:00
altera-pr-ip-core-plat.c	fpga: Explicitly include correct DT includes	2023-07-17 09:23:04 +08:00
altera-pr-ip-core.c
altera-ps-spi.c	fpga: altera: drop driver owner assignment	2024-04-01 16:39:57 +08:00
dfl-afu-dma-region.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
dfl-afu-error.c	fpga: dfl: refactor internal DFL APIs to take/return feature device data	2024-12-18 22:28:48 +08:00
dfl-afu-main.c	fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()	2026-06-01 12:29:13 +08:00
dfl-afu-region.c	fpga: dfl: refactor internal DFL APIs to take/return feature device data	2024-12-18 22:28:48 +08:00
dfl-afu.h	fpga: dfl: refactor internal DFL APIs to take/return feature device data	2024-12-18 22:28:48 +08:00
dfl-fme-br.c	fpga: dfl: drop unneeded get_device() and put_device() of feature device	2024-12-18 22:28:48 +08:00
dfl-fme-error.c	fpga: dfl: refactor internal DFL APIs to take/return feature device data	2024-12-18 22:28:48 +08:00
dfl-fme-main.c	fpga: dfl: refactor internal DFL APIs to take/return feature device data	2024-12-18 22:28:48 +08:00
dfl-fme-mgr.c	fpga: dfl-fme-mgr: Convert to devm_platform_ioremap_resource()	2023-07-10 16:41:44 +08:00
dfl-fme-perf.c	fpga: dfl: more kernel-doc corrections	2023-01-28 23:33:43 +08:00
dfl-fme-pr.c	fpga: dfl: refactor internal DFL APIs to take/return feature device data	2024-12-18 22:28:48 +08:00
dfl-fme-pr.h	fpga: dfl: more kernel-doc corrections	2023-01-28 23:33:43 +08:00
dfl-fme-region.c	fpga: Switch back to struct platform_driver::remove()	2024-11-11 10:43:21 +08:00
dfl-fme.h	fpga: dfl: remove unused member pdata from struct dfl_{afu,fme}	2024-04-23 15:36:33 +08:00
dfl-n3000-nios.c
dfl-pci.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
dfl.c	fpga: dfl: add bounds check in dfh_get_param_size()	2026-06-01 12:28:33 +08:00
dfl.h	fpga: dfl: fix typo in header file	2026-01-22 17:08:06 +08:00
efinix-spi.c	fpga-mgr: Add Efinix SPI programming driver	2026-05-04 19:30:18 +08:00
fpga-bridge.c	fpga: bridge: Use sysfs_emit() instead of sprintf()	2026-03-02 17:47:44 +08:00
fpga-mgr.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
fpga-region.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
ice40-spi.c	fpga: ice40-spi: Don't use "proxy" headers	2024-04-23 15:36:32 +08:00
intel-m10-bmc-sec-update.c	fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit()	2026-03-25 14:57:26 +08:00
Kconfig	fpga-mgr: Add Efinix SPI programming driver	2026-05-04 19:30:18 +08:00
lattice-sysconfig-spi.c	fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()	2026-05-11 23:28:28 +08:00
lattice-sysconfig.c
lattice-sysconfig.h
machxo2-spi.c
Makefile	fpga-mgr: Add Efinix SPI programming driver	2026-05-04 19:30:18 +08:00
microchip-spi.c	fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()	2026-06-01 12:29:40 +08:00
of-fpga-region.c	fpga: region: fix use-after-free in child_regions_with_firmware()	2026-05-04 19:27:05 +08:00
socfpga-a10.c	fpga: Switch back to struct platform_driver::remove()	2024-11-11 10:43:21 +08:00
socfpga.c	fpga: socfpga: Rename 'timeout' variable as 'time_left'	2024-08-14 23:57:07 +08:00
stratix10-soc.c	fpga: Switch back to struct platform_driver::remove()	2024-11-11 10:43:21 +08:00
ts73xx-fpga.c	fpga: ts73xx-fpga: add OF match table for device tree probing	2026-05-04 19:28:18 +08:00
versal-fpga.c	fpga: versal: remove incorrect of_match_ptr annotation	2025-03-01 17:37:31 +08:00
xilinx-core.c	fpga: xilinx-core: add new gpio names for prog and init	2024-03-31 22:48:13 +08:00
xilinx-core.h	fpga: xilinx-spi: extract a common driver core	2024-03-31 22:41:26 +08:00
xilinx-pr-decoupler.c	fpga: xilinx: Switch Michal Simek's email to new one	2025-12-19 23:40:38 +08:00
xilinx-selectmap.c	fpga: xilinx-selectmap: add new driver	2024-03-31 22:44:21 +08:00
xilinx-spi.c	fpga: xilinx-spi: Add missing spi_device_id table	2025-11-10 15:02:07 +08:00
zynq-fpga.c	fpga: xilinx: Switch Michal Simek's email to new one	2025-12-19 23:40:38 +08:00
zynqmp-fpga.c	fpga: zynqmp-fpga: Adds status interface	2023-03-09 17:33:19 +01:00