From e8688854f897d317d2bb1a32675f96977874d1b8 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Sun, 5 Jul 2026 22:01:27 +0800 Subject: [PATCH 1/3] drivers: fix CFI MTD array bounds checks Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/drivers/mtd/mtd-cfi.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/components/drivers/mtd/mtd-cfi.c b/components/drivers/mtd/mtd-cfi.c index ef93d12b801..b8b8651e2d8 100644 --- a/components/drivers/mtd/mtd-cfi.c +++ b/components/drivers/mtd/mtd-cfi.c @@ -1066,6 +1066,13 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi fdev->vendor = rt_le16_to_cpu(get_unaligned(&query->primary_id)); fdev->ext_addr = rt_le16_to_cpu(get_unaligned(&query->primary_address)); num_erase_regions = query->num_erase_regions; + if (num_erase_regions > RT_ARRAY_SIZE(query->erase_region_info)) + { + LOG_E("Too many %d (> %d) erase regions found", + num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); + num_erase_regions = RT_ARRAY_SIZE(query->erase_region_info); + query->num_erase_regions = num_erase_regions; + } if (fdev->ext_addr) { @@ -1138,13 +1145,6 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi for (int i = 0; i < num_erase_regions; ++i) { - if (i > RT_ARRAY_SIZE(query->erase_region_info)) - { - LOG_E("Too many %d (> %d) erase regions found", - num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); - break; - } - value = rt_le32_to_cpu(get_unaligned(&query->erase_region_info[i])); erase_region_count = (value & 0xffff) + 1; @@ -1158,7 +1158,7 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi break; } - if (sect_count > RT_ARRAY_SIZE(fdev->sect)) + if (sect_count >= RT_ARRAY_SIZE(fdev->sect)) { LOG_E("Too many %d (> %d) sector found", sect_count, RT_ARRAY_SIZE(fdev->sect)); From 7d077e09a290f35a1fa9ac82290090e7f013f832 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Sun, 12 Jul 2026 03:00:48 +0800 Subject: [PATCH 2/3] drivers: reject truncated CFI erase geometry A truncated erase-region table leaves the full flash size registered with only part of its sector geometry. Fail probing instead of exposing a device whose erase address lookup can select the wrong sector. Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/drivers/mtd/mtd-cfi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/drivers/mtd/mtd-cfi.c b/components/drivers/mtd/mtd-cfi.c index b8b8651e2d8..d553ecc4616 100644 --- a/components/drivers/mtd/mtd-cfi.c +++ b/components/drivers/mtd/mtd-cfi.c @@ -1070,8 +1070,8 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi { LOG_E("Too many %d (> %d) erase regions found", num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); - num_erase_regions = RT_ARRAY_SIZE(query->erase_region_info); - query->num_erase_regions = num_erase_regions; + err = -RT_EINVAL; + goto _fail; } if (fdev->ext_addr) From b63da3b16f307080fcff60b81e02137612c2194b Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Sun, 12 Jul 2026 03:06:06 +0800 Subject: [PATCH 3/3] drivers: fix CFI log indentation Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/drivers/mtd/mtd-cfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/drivers/mtd/mtd-cfi.c b/components/drivers/mtd/mtd-cfi.c index d553ecc4616..3f00b110ca3 100644 --- a/components/drivers/mtd/mtd-cfi.c +++ b/components/drivers/mtd/mtd-cfi.c @@ -1069,7 +1069,7 @@ static rt_err_t cfi_flash_dev_probe(struct rt_device *dev, struct cfi_flash_devi if (num_erase_regions > RT_ARRAY_SIZE(query->erase_region_info)) { LOG_E("Too many %d (> %d) erase regions found", - num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); + num_erase_regions, RT_ARRAY_SIZE(query->erase_region_info)); err = -RT_EINVAL; goto _fail; }