ACK/Cmnt: [SRU][N][PATCH 1/1] objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()

[Andrei Gherzan]

On 26/09/09 08:13PM, Cengiz Can via kernel-team wrote:
> From: Josh Poimboeuf <jpoimboe at kernel.org>
> 
> If speed_hz < AMD_SPI_MIN_HZ, amd_set_spi_freq() iterates over the
> entire amd_spi_freq array without breaking out early, causing 'i' to go
> beyond the array bounds.
> 
> Fix that by stopping the loop when it gets to the last entry, so the low
> speed_hz value gets clamped up to AMD_SPI_MIN_HZ.
> 
> Fixes the following warning with an UBSAN kernel:
> 
>   drivers/spi/spi-amd.o: error: objtool: amd_set_spi_freq() falls through to next function amd_spi_set_opcode()
> 
> Fixes: 3fe26121dc3a ("spi: amd: Configure device speed")
> Reported-by: kernel test robot <lkp at intel.com>
> Signed-off-by: Josh Poimboeuf <jpoimboe at kernel.org>
> Signed-off-by: Ingo Molnar <mingo at kernel.org>
> Acked-by: Mark Brown <broonie at kernel.org>
> Cc: Raju Rangoju <Raju.Rangoju at amd.com>
> Cc: Linus Torvalds <torvalds at linux-foundation.org>
> Link: https://lore.kernel.org/r/78fef0f2434f35be9095bcc9ffa23dd8cab667b9.1742852847.git.jpoimboe@kernel.org
> Closes: https://lore.kernel.org/r/202503161828.RUk9EhWx-lkp@intel.com/
> (backported from commit 76e51db43fe4aaaebcc5ddda67b0807f7c9bdecc)
> [bot_kybele: Applied the loop-bound -1 change; kept this tree's pre-existing
>  early guard (returns -EINVAL when speed_hz < AMD_SPI_MIN_HZ), which the
>  upstream void version lacks.]
> CVE-2025-40014
> Assisted-by: kybele:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
>  drivers/spi/spi-amd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
> index 5d9b246b6963..249fc3a60b22 100644
> --- a/drivers/spi/spi-amd.c
> +++ b/drivers/spi/spi-amd.c
> @@ -243,7 +243,7 @@ static int amd_set_spi_freq(struct amd_spi *amd_spi, u32 speed_hz)
>  	if (speed_hz < AMD_SPI_MIN_HZ)
>  		return -EINVAL;
>  
> -	for (i = 0; i < ARRAY_SIZE(amd_spi_freq); i++)
> +	for (i = 0; i < ARRAY_SIZE(amd_spi_freq)-1; i++)
>  		if (speed_hz >= amd_spi_freq[i].speed_hz)
>  			break;

amd_spi_freq in Noble is defined as:

[0] 100000000  [1] 66660000  [2] 50000000  [3] 33330000  [4] 22220000                                    
[5] 16660000   [6] 4000000   [7] 3170000   [8] 800000  == AMD_SPI_MIN_HZ   

While AMD_SPI_MIN_HZ is exactly the last entry so the loop will never go over
iteration i<=7 with or without this patch because of the following guard:

if (speed_hz < AMD_SPI_MIN_HZ)                                                                         
  return -EINVAL;  

As such, Noble should have been tracked as not-affected for CVE-2025-40014.
Applying it anyway is harmless, so this is a bookkeeping/justification issue,
not a code defect.

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/df9349c6/attachment.sig>