Message ID | 20231003131343.1324962-1-loic.poulain@linaro.org |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2a8e:b0:403:3b70:6f57 with SMTP id in14csp2075628vqb; Tue, 3 Oct 2023 06:13:56 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFOWfCcOqGLtEqXIeOLCxT1NqOxRZEsGGNPb8bQZNuI6nuzyOYFYSjb5V/T1fq9MWO/Q/fo X-Received: by 2002:a05:6808:144:b0:3a7:4b9a:43c2 with SMTP id h4-20020a056808014400b003a74b9a43c2mr15225943oie.13.1696338836262; Tue, 03 Oct 2023 06:13:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696338836; cv=none; d=google.com; s=arc-20160816; b=NxnDfUHmikcX9vJSbOMtu3/B3dEf6PnVTq72drl2rr41oNnGY5tCMIEiOPIz4ECRUs otYrfv5v/4lcZ1Jlt/7dCAYeuJ7mynrBqdKlDqx6ElmNlqNMRIGwi8xMztKKC+cUWAkA AMOa6cli0aheem1jPEvJTjMWhtmlNx36nb/F56470Hp1lwMx68k6TUldWuM+gB/ukc3g 7UV/kCCN1FToa2e/M05geiwQqxWIzR/OJMSdF+Yb17Zgdyk9cce9/1YAxLv1+tpbgeCN okVlmvi/zgYF91pas5ywLDCovp1ns9GZm0dJdbQug+EOArS/7xyxvdw6KxiRyjgw8GbZ ZTFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=JvJMFPN5XnfTryJd6+O+n7ZB7bWg89FdCPQdvOsvcr4=; fh=GRc03QHWzJheY14R1UYBRGInOraefwKenACZIKjssIg=; b=KX7tTBJemoHxUxFjhTiZ+qtB+sAyVtj+aXcUM/bIkYvzvHJI5grJOBlPjOeclyhdYO PDJxMlBPJ8C4naia63xmh4Ba9zvAHwOdIyrAHWAEoOWSA5XeocUxR8iPV5k66CVPb6qG XRXMymvmz7aP9LF/TevBvZFARPdQR6j03m25DQDTFyxxDTCyQayVJ4bnHuT0NbG2Uqbb 1LDypAHXNJSE3Gufv5/W7TCuWHtO7v/+kaD4CS42fLII6gTxebLsT5yT2jbSg0OYAKAb ZmQVGZ1wT8KSBvR4trBAqD7MAQt3exgm4GwLkErBRN9/enUFzm07bsajkCbLnifui/PA uSUQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=soAZbw6j; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id fz14-20020a17090b024e00b00268a8e0cab3si9464822pjb.178.2023.10.03.06.13.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Oct 2023 06:13:56 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=soAZbw6j; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id A7CF780DEA78; Tue, 3 Oct 2023 06:13:55 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232608AbjJCNNx (ORCPT <rfc822;chrisfriedt@gmail.com> + 17 others); Tue, 3 Oct 2023 09:13:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232177AbjJCNNw (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Tue, 3 Oct 2023 09:13:52 -0400 Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56613A3 for <linux-kernel@vger.kernel.org>; Tue, 3 Oct 2023 06:13:49 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id 5b1f17b1804b1-405361bba99so8752675e9.2 for <linux-kernel@vger.kernel.org>; Tue, 03 Oct 2023 06:13:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1696338828; x=1696943628; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=JvJMFPN5XnfTryJd6+O+n7ZB7bWg89FdCPQdvOsvcr4=; b=soAZbw6jmNVjeh6/UtRaQcV7puJBnxWddrgWrdbrVqsm8mzJR7bt/hhkAXXdLIdqOZ G3mSQhZOC5kJLNNUefguldj8lvAoNWcPsAtJtofVovVENH5jjy8bJZXYzhmAguCzNOVY NXO+CP/KPLEBQ+SGz/JUFAft3UVupfwjyli09i3uVW8ZGld4f5Y31U2VsL0/sRoK5d4X tD+OYGzgMO3Hgszz5VMtodd4Dvqm5GPIBLEMLTo8lWMdvSnR8xLJxfaJYW6BiIQqH3P5 g5SiNVA3y7NBBQLbWtKHdL/n2s7sHpQ0q0+eEEo5OCmqXNvFU/yvrcjELhWaw3QSlvSs XFZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696338828; x=1696943628; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=JvJMFPN5XnfTryJd6+O+n7ZB7bWg89FdCPQdvOsvcr4=; b=Lt9fh5gvT7aej01g7Gnyhv+S43H6J45BBlxdKfhI6SMpM9DeDWyDxxsM4pBb4G46jl iCpMnkHX46YT7mXZwRJ56hfdVWnclTo04rdgzjnPkIEilGYQiadA8ixFQXZ/q7Foubwq nJM4Q2XTzJxOZN4RVFR9j/hQu0p+0zmdd/RjSH9PDorDB0E3mRz1zS4mtA6PGo11Up79 xbNl+UjwLWgqfRG6cltwOPpDPGlqKlRn5IEIFb0V21/VbGtG6PZFIpdqXKt2lXCxG6sN afUO2ktXQ4NOOROEQvxBBZ+bOqjec6ngp4mfBprvi6RAT7IAx9NpC900hitARbANm4iz Y7CQ== X-Gm-Message-State: AOJu0YxDPSLN6rVZdX4uLi19DQqGE71RvR3fyWqWgarIhiY9GKLYWCg1 13mCWzWF7vdtXaIQl+kIlPg4yI5o5sJvsDAGGhqbfA== X-Received: by 2002:a05:600c:207:b0:3fe:f74c:b4f6 with SMTP id 7-20020a05600c020700b003fef74cb4f6mr13419469wmi.17.1696338827645; Tue, 03 Oct 2023 06:13:47 -0700 (PDT) Received: from loic-ThinkPad-T470p.. ([2a01:e0a:82c:5f0:6937:1bb0:405c:b59c]) by smtp.gmail.com with ESMTPSA id c4-20020a05600c0ac400b00405442edc69sm9385112wmr.14.2023.10.03.06.13.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Oct 2023 06:13:46 -0700 (PDT) From: Loic Poulain <loic.poulain@linaro.org> To: srinivas.kandagatla@linaro.org Cc: linux-kernel@vger.kernel.org, Loic Poulain <loic.poulain@linaro.org> Subject: [PATCH] nvmem: core: Fix possible buffer overflow on nvmem cell write Date: Tue, 3 Oct 2023 15:13:43 +0200 Message-Id: <20231003131343.1324962-1-loic.poulain@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Tue, 03 Oct 2023 06:13:55 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778740191643061249 X-GMAIL-MSGID: 1778740191643061249 |
Series |
nvmem: core: Fix possible buffer overflow on nvmem cell write
|
|
Commit Message
Loic Poulain
Oct. 3, 2023, 1:13 p.m. UTC
Nothing prevents a nvmem consumer to try writing excessive data to a
given nvmem cell (except when bit_offset is 0). The allocated buffer
of size 'cell->bytes' in nvmem_cell_prepare_write_buffer may not be
large enough to host the copied 'len' bytes.
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
---
drivers/nvmem/core.c | 3 +++
1 file changed, 3 insertions(+)
Comments
Thanks Loic for the patch, On 03/10/2023 14:13, Loic Poulain wrote: > Nothing prevents a nvmem consumer to try writing excessive data to a > given nvmem cell (except when bit_offset is 0). The allocated buffer > of size 'cell->bytes' in nvmem_cell_prepare_write_buffer may not be > large enough to host the copied 'len' bytes. > Did you hit this path? __nvmem_cell_entry_write already has a check for (cell->bit_offset == 0 && len != cell->bytes)) What is the bit_offset in your case? Can you provide more details? thanks, srini > Signed-off-by: Loic Poulain <loic.poulain@linaro.org> > --- > drivers/nvmem/core.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c > index eaf6a3fe8ca6..0b27ab3b3b86 100644 > --- a/drivers/nvmem/core.c > +++ b/drivers/nvmem/core.c > @@ -1654,6 +1654,9 @@ static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell, > int i, rc, nbits, bit_offset = cell->bit_offset; > u8 v, *p, *buf, *b, pbyte, pbits; > > + if (len > cell->bytes) > + return ERR_PTR(-EINVAL); > + > nbits = cell->nbits; > buf = kzalloc(cell->bytes, GFP_KERNEL); > if (!buf)
Hi Srini, On Sat, 7 Oct 2023 at 12:22, Srinivas Kandagatla <srinivas.kandagatla@linaro.org> wrote: > > Thanks Loic for the patch, > > On 03/10/2023 14:13, Loic Poulain wrote: > > Nothing prevents a nvmem consumer to try writing excessive data to a > > given nvmem cell (except when bit_offset is 0). The allocated buffer > > of size 'cell->bytes' in nvmem_cell_prepare_write_buffer may not be > > large enough to host the copied 'len' bytes. > > > Did you hit this path? > > __nvmem_cell_entry_write already has a check for (cell->bit_offset == > 0 && len != cell->bytes)) > > What is the bit_offset in your case? > > Can you provide more details? I hit the issue while playing with nvmem-reboot-mode driver, allocating 2-bit of a persistent register at bit-offset 2 for the reboot mode. nvmem-reboot-mode drivers call nvmem_cell_write() with a 32-bit len value, so we end in nvmem_cell_prepare_write_buffer allocating a 1-byte (cell->bytes) buffer and copying a 4-byte len value into it. You can find below the dts example. ``` { &snvs_lpgpr{ #address-cells = <1>; #size-cells = <1>; something@0 { /* reg[2:0] */ reg = <0x0 0x4>; bits = <2 2>; }; reboot_mode: reboot-mode@0 { /* reg[4:2] */ reg = <0x0 0x4>; bits = <2 2>; }; }; reboot-mode { compatible = "nvmem-reboot-mode"; nvmem-cells = <&reboot_mode>; nvmem-cell-names = "reboot-mode"; mode-normal = <0>; mode-fastboot = <1>; mode-recovery = <2>; }; }; ```
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index eaf6a3fe8ca6..0b27ab3b3b86 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1654,6 +1654,9 @@ static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell, int i, rc, nbits, bit_offset = cell->bit_offset; u8 v, *p, *buf, *b, pbyte, pbits; + if (len > cell->bytes) + return ERR_PTR(-EINVAL); + nbits = cell->nbits; buf = kzalloc(cell->bytes, GFP_KERNEL); if (!buf)