[PATCH] nvmem: brcm_nvram: validate cached NVRAM length

[PATCH] nvmem: brcm_nvram: validate cached NVRAM length

[Pengpeng Hou]

The cached-content conversion stops at the partition padding.  Therefore,
data_len may be smaller than nvmem_size.  brcm_nvram_parse() checks
header->len against nvmem_size, then passes that length to
brcm_nvram_add_cells(), which temporarily writes data[len - 1] and parses
NUL-separated entries.

A corrupted header can declare a length that fits the MMIO resource but
exceeds the cached allocation.  Also reject a cached object that is too
small for the header, and reject declared lengths shorter than the header.

Validate the declaration against data_len, which bounds the parsed object.

Fixes: 1e37bf84afac ("nvmem: brcm_nvram: store a copy of NVRAM content")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/nvmem/brcm_nvram.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
index aaa6537798bf..4701772cfa47 100644
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -181,15 +181,21 @@ static int brcm_nvram_parse(struct brcm_nvram *priv)
 	size_t len;
 	int err;
 
+	if (priv->data_len < sizeof(*header)) {
+		dev_err(dev, "NVRAM content (%zu) is smaller than header (%zu)\n",
+			priv->data_len, sizeof(*header));
+		return -EINVAL;
+	}
+
 	if (memcmp(header->magic, NVRAM_MAGIC, 4)) {
 		dev_err(dev, "Invalid NVRAM magic\n");
 		return -EINVAL;
 	}
 
 	len = le32_to_cpu(header->len);
-	if (len > priv->nvmem_size) {
-		dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len,
-			priv->nvmem_size);
+	if (len < sizeof(*header) || len > priv->data_len) {
+		dev_err(dev, "NVRAM length (%zu) is outside cached content (%zu)\n",
+			len, priv->data_len);
 		return -EINVAL;
 	}
 
-- 
2.43.0

Re: [PATCH] nvmem: brcm_nvram: validate cached NVRAM length

[Srinivas Kandagatla]

On 7/15/26 9:45 AM, Pengpeng Hou wrote:
> The cached-content conversion stops at the partition padding.  Therefore,
> data_len may be smaller than nvmem_size.  brcm_nvram_parse() checks
> header->len against nvmem_size, then passes that length to
> brcm_nvram_add_cells(), which temporarily writes data[len - 1] and parses
> NUL-separated entries.
> 
> A corrupted header can declare a length that fits the MMIO resource but
> exceeds the cached allocation.  Also reject a cached object that is too
> small for the header, and reject declared lengths shorter than the header.
> 
> Validate the declaration against data_len, which bounds the parsed object.
> 
> Fixes: 1e37bf84afac ("nvmem: brcm_nvram: store a copy of NVRAM content")
> Cc: stable@vger.kernel.org
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

There are already few patches on the list which are doing pretty much
same changes, i have applied them which should appear in linux-next in a
day.

https://lkml.org/lkml/2026/7/3/2291

--srini
> ---
>  drivers/nvmem/brcm_nvram.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
> index aaa6537798bf..4701772cfa47 100644
> --- a/drivers/nvmem/brcm_nvram.c
> +++ b/drivers/nvmem/brcm_nvram.c
> @@ -181,15 +181,21 @@ static int brcm_nvram_parse(struct brcm_nvram *priv)
>  	size_t len;
>  	int err;
>  
> +	if (priv->data_len < sizeof(*header)) {
> +		dev_err(dev, "NVRAM content (%zu) is smaller than header (%zu)\n",
> +			priv->data_len, sizeof(*header));
> +		return -EINVAL;
> +	}
> +
>  	if (memcmp(header->magic, NVRAM_MAGIC, 4)) {
>  		dev_err(dev, "Invalid NVRAM magic\n");
>  		return -EINVAL;
>  	}
>  
>  	len = le32_to_cpu(header->len);
> -	if (len > priv->nvmem_size) {
> -		dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len,
> -			priv->nvmem_size);
> +	if (len < sizeof(*header) || len > priv->data_len) {
> +		dev_err(dev, "NVRAM length (%zu) is outside cached content (%zu)\n",
> +			len, priv->data_len);
>  		return -EINVAL;
>  	}
>