mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 03:35:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data

Browse Source 
The length check in brcm_nvram_parse() validated header->len against
priv->nvmem_size (the full partition size) instead of priv->data_len
(the actual allocated data buffer). A malformed flash partition with
header->len between the two would pass the check, causing
brcm_nvram_add_cells() to read and write priv->data[len - 1] beyond
the heap allocation.

Also add a minimum bound: len < sizeof(*header) could underflow the
data[len - 1] access.

Fix both bounds by rejecting len outside [sizeof(*header), priv->data_len].

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-14-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rosen Penev
2026-07-29 10:46:46 +01:00
committed by Greg Kroah-Hartman
parent fde46579cf
commit a67e2c323a
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/nvmem/brcm_nvram.c
View File

@@ -192,9 +192,13 @@ static int brcm_nvram_parse(struct brcm_nvram *priv)
}
len = le32_to_cpu(header->len);
if (len > priv->nvmem_size) {
dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len,
priv->nvmem_size);
if (len < sizeof(*header)) {
dev_err(dev, "NVRAM length (%zd) too small\n", len);
return -EINVAL;
}
if (len > priv->data_len) {
dev_err(dev, "NVRAM length (%zd) exceeds data size (%zd)\n", len,
priv->data_len);
return -EINVAL;
}