On 12/23/25 08:28, Kees Cook wrote:
On Fri, Dec 19, 2025 at 08:20:13PM -0800, Randy Dunlap wrote:
from kernel bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=220823
Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in
/var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
(from drivers/mtd/devices/mtd_intel_dg.c:)
nvm = kzalloc(struct_size(nvm, regions, nregions), GFP_KERNEL);
Yes, this needs to be immediately followed with:
nvm->nregions = nregions;
I submitted a fix for this that day:
https://lore.kernel.org/linux-hardening/aUZFLezigzZQVt55@kspp/
It seems someone had submitted a patch in Nov, but it was
never applied upstream.
-Gustavo
