From 237facd8950eae33aa0a09c8e39099e0cbeb92c0 Mon Sep 17 00:00:00 2001 From: armando Date: Thu, 5 Mar 2026 17:16:55 +0800 Subject: [PATCH] fix(mmap): added 24bit addr check --- components/spi_flash/flash_mmap.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/components/spi_flash/flash_mmap.c b/components/spi_flash/flash_mmap.c index 074ff9b6ce8..ebcccc91585 100644 --- a/components/spi_flash/flash_mmap.c +++ b/components/spi_flash/flash_mmap.c @@ -1,15 +1,17 @@ /* - * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ +#include #include #include #include #include #include #include "sdkconfig.h" +#include "esp_bit_defs.h" #include "esp_attr.h" #include "esp_log.h" #include "esp_rom_caps.h" @@ -48,6 +50,8 @@ extern char _rodata_reserved_end; #if !CONFIG_SPI_FLASH_ROM_IMPL +/* 0x1000000, 16MB */ +#define FLASH_MMAP_ADDR_24BIT_MAX (BIT(24)) typedef struct mmap_block_t { uint32_t *vaddr_list; @@ -58,6 +62,12 @@ typedef struct mmap_block_t { esp_err_t spi_flash_mmap(size_t src_addr, size_t size, spi_flash_mmap_memory_t memory, const void** out_ptr, spi_flash_mmap_handle_t* out_handle) { +#if !CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH && !CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH + if (src_addr >= FLASH_MMAP_ADDR_24BIT_MAX || size > FLASH_MMAP_ADDR_24BIT_MAX || src_addr > FLASH_MMAP_ADDR_24BIT_MAX - size) { + ESP_LOGE("flash_mmap", "Address 0x%08zx is out of range for 24bit flash mapping, see CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH and CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH for more details", src_addr); + return ESP_ERR_INVALID_ARG; + } +#endif esp_err_t ret = ESP_FAIL; mmu_mem_caps_t caps = 0; void *ptr = NULL; @@ -163,6 +173,15 @@ static void s_pages_to_bytes(int (*blocks)[2], int block_nums) esp_err_t spi_flash_mmap_pages(const int *pages, size_t page_count, spi_flash_mmap_memory_t memory, const void** out_ptr, spi_flash_mmap_handle_t* out_handle) { +#if !CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH && !CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH + for (size_t i = 0; i < page_count; i++) { + uint32_t phys = (uint32_t)pages[i] * CONFIG_MMU_PAGE_SIZE; + if (phys >= FLASH_MMAP_ADDR_24BIT_MAX) { + ESP_LOGE("flash_mmap", "Page %d (addr 0x%08" PRIx32 ") is out of range for 24bit flash mapping", pages[i], phys); + return ESP_ERR_INVALID_ARG; + } + } +#endif esp_err_t ret = ESP_FAIL; mmu_mem_caps_t caps = 0; mmap_block_t *block = NULL;