From patchwork Tue Oct 3 13:13:43 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Loic Poulain X-Patchwork-Id: 147865 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2a8e:b0:403:3b70:6f57 with SMTP id in14csp2075628vqb; Tue, 3 Oct 2023 06:13:56 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFOWfCcOqGLtEqXIeOLCxT1NqOxRZEsGGNPb8bQZNuI6nuzyOYFYSjb5V/T1fq9MWO/Q/fo X-Received: by 2002:a05:6808:144:b0:3a7:4b9a:43c2 with SMTP id h4-20020a056808014400b003a74b9a43c2mr15225943oie.13.1696338836262; Tue, 03 Oct 2023 06:13:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696338836; cv=none; d=google.com; s=arc-20160816; b=NxnDfUHmikcX9vJSbOMtu3/B3dEf6PnVTq72drl2rr41oNnGY5tCMIEiOPIz4ECRUs otYrfv5v/4lcZ1Jlt/7dCAYeuJ7mynrBqdKlDqx6ElmNlqNMRIGwi8xMztKKC+cUWAkA AMOa6cli0aheem1jPEvJTjMWhtmlNx36nb/F56470Hp1lwMx68k6TUldWuM+gB/ukc3g 7UV/kCCN1FToa2e/M05geiwQqxWIzR/OJMSdF+Yb17Zgdyk9cce9/1YAxLv1+tpbgeCN okVlmvi/zgYF91pas5ywLDCovp1ns9GZm0dJdbQug+EOArS/7xyxvdw6KxiRyjgw8GbZ ZTFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=JvJMFPN5XnfTryJd6+O+n7ZB7bWg89FdCPQdvOsvcr4=; fh=GRc03QHWzJheY14R1UYBRGInOraefwKenACZIKjssIg=; b=KX7tTBJemoHxUxFjhTiZ+qtB+sAyVtj+aXcUM/bIkYvzvHJI5grJOBlPjOeclyhdYO PDJxMlBPJ8C4naia63xmh4Ba9zvAHwOdIyrAHWAEoOWSA5XeocUxR8iPV5k66CVPb6qG XRXMymvmz7aP9LF/TevBvZFARPdQR6j03m25DQDTFyxxDTCyQayVJ4bnHuT0NbG2Uqbb 1LDypAHXNJSE3Gufv5/W7TCuWHtO7v/+kaD4CS42fLII6gTxebLsT5yT2jbSg0OYAKAb ZmQVGZ1wT8KSBvR4trBAqD7MAQt3exgm4GwLkErBRN9/enUFzm07bsajkCbLnifui/PA uSUQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=soAZbw6j; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id fz14-20020a17090b024e00b00268a8e0cab3si9464822pjb.178.2023.10.03.06.13.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Oct 2023 06:13:56 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=soAZbw6j; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id A7CF780DEA78; Tue, 3 Oct 2023 06:13:55 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232608AbjJCNNx (ORCPT + 17 others); Tue, 3 Oct 2023 09:13:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232177AbjJCNNw (ORCPT ); Tue, 3 Oct 2023 09:13:52 -0400 Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56613A3 for ; Tue, 3 Oct 2023 06:13:49 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id 5b1f17b1804b1-405361bba99so8752675e9.2 for ; Tue, 03 Oct 2023 06:13:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1696338828; x=1696943628; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=JvJMFPN5XnfTryJd6+O+n7ZB7bWg89FdCPQdvOsvcr4=; b=soAZbw6jmNVjeh6/UtRaQcV7puJBnxWddrgWrdbrVqsm8mzJR7bt/hhkAXXdLIdqOZ G3mSQhZOC5kJLNNUefguldj8lvAoNWcPsAtJtofVovVENH5jjy8bJZXYzhmAguCzNOVY NXO+CP/KPLEBQ+SGz/JUFAft3UVupfwjyli09i3uVW8ZGld4f5Y31U2VsL0/sRoK5d4X tD+OYGzgMO3Hgszz5VMtodd4Dvqm5GPIBLEMLTo8lWMdvSnR8xLJxfaJYW6BiIQqH3P5 g5SiNVA3y7NBBQLbWtKHdL/n2s7sHpQ0q0+eEEo5OCmqXNvFU/yvrcjELhWaw3QSlvSs XFZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696338828; x=1696943628; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=JvJMFPN5XnfTryJd6+O+n7ZB7bWg89FdCPQdvOsvcr4=; b=Lt9fh5gvT7aej01g7Gnyhv+S43H6J45BBlxdKfhI6SMpM9DeDWyDxxsM4pBb4G46jl iCpMnkHX46YT7mXZwRJ56hfdVWnclTo04rdgzjnPkIEilGYQiadA8ixFQXZ/q7Foubwq nJM4Q2XTzJxOZN4RVFR9j/hQu0p+0zmdd/RjSH9PDorDB0E3mRz1zS4mtA6PGo11Up79 xbNl+UjwLWgqfRG6cltwOPpDPGlqKlRn5IEIFb0V21/VbGtG6PZFIpdqXKt2lXCxG6sN afUO2ktXQ4NOOROEQvxBBZ+bOqjec6ngp4mfBprvi6RAT7IAx9NpC900hitARbANm4iz Y7CQ== X-Gm-Message-State: AOJu0YxDPSLN6rVZdX4uLi19DQqGE71RvR3fyWqWgarIhiY9GKLYWCg1 13mCWzWF7vdtXaIQl+kIlPg4yI5o5sJvsDAGGhqbfA== X-Received: by 2002:a05:600c:207:b0:3fe:f74c:b4f6 with SMTP id 7-20020a05600c020700b003fef74cb4f6mr13419469wmi.17.1696338827645; Tue, 03 Oct 2023 06:13:47 -0700 (PDT) Received: from loic-ThinkPad-T470p.. ([2a01:e0a:82c:5f0:6937:1bb0:405c:b59c]) by smtp.gmail.com with ESMTPSA id c4-20020a05600c0ac400b00405442edc69sm9385112wmr.14.2023.10.03.06.13.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Oct 2023 06:13:46 -0700 (PDT) From: Loic Poulain To: srinivas.kandagatla@linaro.org Cc: linux-kernel@vger.kernel.org, Loic Poulain Subject: [PATCH] nvmem: core: Fix possible buffer overflow on nvmem cell write Date: Tue, 3 Oct 2023 15:13:43 +0200 Message-Id: <20231003131343.1324962-1-loic.poulain@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Tue, 03 Oct 2023 06:13:55 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778740191643061249 X-GMAIL-MSGID: 1778740191643061249 Nothing prevents a nvmem consumer to try writing excessive data to a given nvmem cell (except when bit_offset is 0). The allocated buffer of size 'cell->bytes' in nvmem_cell_prepare_write_buffer may not be large enough to host the copied 'len' bytes. Signed-off-by: Loic Poulain --- drivers/nvmem/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index eaf6a3fe8ca6..0b27ab3b3b86 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1654,6 +1654,9 @@ static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell, int i, rc, nbits, bit_offset = cell->bit_offset; u8 v, *p, *buf, *b, pbyte, pbits; + if (len > cell->bytes) + return ERR_PTR(-EINVAL); + nbits = cell->nbits; buf = kzalloc(cell->bytes, GFP_KERNEL); if (!buf)