From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC0E7433E7F for ; Fri, 3 Jul 2026 22:28:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783117714; cv=none; b=TjpcmS6g5mg/I4odqJgzkPtGyMIj68K2cUUx9t9S1z3YZzmq5awXKK8/5vmtdYZL3ofC2LDrMKLieUDIv1QT0e+Yc/94wVkqfOIjIS7P7qf22V1CoHcDlzTha6UYeWzXQzO6egHKXwi/iJjSwOP+kSfRr1DaXht9m7OTyDTtJ3A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783117714; c=relaxed/simple; bh=w+iQ04sziOe7IMzXnhl8mLH/Phkj9LGHx8yVH3raXAU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=N0SuC7tK44qjRb726z4e+iyZEabKaWeruWXtEQXkK7VVynEjzbq6tCx+BEYUp4GwO4Emy1hzQ3nxX9mVkY067g7ba+mlNuQ/S1EVlvTppZlNXMuDKNivBew169retrAkkE/p6vjK1LoZMz6U9HclVBRTqxtTeWOqI39EWJrtJwQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hiDLGVDr; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hiDLGVDr" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cabc0a1ab6so9435145ad.0 for ; Fri, 03 Jul 2026 15:28:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783117713; x=1783722513; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=lpzU0nve6IHijLvqZ03WzY/KmFVAylJXe+dr/ied3Os=; b=hiDLGVDrDHRz1q5Rmt9LilrJx/7PiT4OgT6oFjTaKGM0npTrm9L2/h1bHjk1oZIVFM mC0HX0N4TK+u8Fz+acQJDWd3xmM5nDUi29s/r1Qjc0gcxXM37QqPXQnAxZwoEscKqBc1 t8t7CDrgtwzqb1Yrue0hCYJbCC7AbgXkMCjoi9ji00dIFNnRAb5zAGsJcNwzejlCvIyz HfbtT8a/RPIrqHs4vejMtkJZluKyCkAb63X1iF1RQ7DZv5o7ON4te6902gH4RkcloHsF tQ1UEEhVk7QA/HlRIP7SV6bBEkHt5pFTr0Icf0olg9p3xq7dbDvji5bPJEqJAHdkhizf XweQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783117713; x=1783722513; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=lpzU0nve6IHijLvqZ03WzY/KmFVAylJXe+dr/ied3Os=; b=F8p6IwPjIyWSpsiedBkhFl60NUdNsZxSLbaKkM1uTjTWhe1mFI4M34Q8ZZgMEQwiOH tlO1kpa1rGN5SJnUISax1r55EmfkHt6zy3MWNAGZSgUhGrPFjHXNt1NGTqjRsWvBtu/l T2n9exmutL6uycYOHEMckijZjw9ISrXyoCa/9GDkveC9mc9zQlTqTOuAErhoTBHeMX/T AKwJeJLsUYPCikScSKTRoF3Z/P+io0EeYBpIxjFm5MgAfYK8i2xQf2IC2PrQuL8G4Doc A7V7i9cdoFCRpBO7/3qEYINep7fj4cDR1qpMS7FYaiyIbD4O2AuYYrmAYvH7jjcmirUe JEOQ== X-Gm-Message-State: AOJu0YxKOAKZh4YM0KAVi3QtkjRkN4br1jIQUXlCEmUAnjZlTXrfIwv9 cqZo6uZzXrk+6CiC/KAe9Ls8UFuFxq5tNG0FOY+PBhjbbMjZejuEGgwHsEf8iQ== X-Gm-Gg: AfdE7cmwe5gyVYrd3zDhLTfMhjJuY3pIhjZecGCGCY0Ef9QCi1G+O0/ebzOIbYnu0nf 4OQzERmwwfZEftrKPFmxeqOgL1y+fCLPjUXyJ9U8AE065c6EWqjG5MoebFNuRYH8o9BBpcbmPk7 I8wy07CMaL79OogOqXmjXZN8+WdDzBv3tQYh6BSjDR4oEEpTWiQ2Q8kXG5gUNiXwPNAUhkxkE4l 3ZmRELKFQ3MAyCOEoYVs3Y/2F6JlWbp4NKJmrxBgUt2c52S53Wp/aqHmdoc6zqfmkC8ijDfMnaP 40IuSxNwsSj6f6vcDAzwXhvcZVfCW4VQDyA9K2fz9tu2wt10K7kSa/19AfZRAU/zHNbv/lcCY6E AvSt185vWRkoj80zhREPkKSWPweHBEU/dukHM3D9DejjtSN9RvwgSTMW/N+9MjGp/jS0EIBZ+c5 wSO/kLYU0WokSZtZj+pxHQnPh/VMM7N/g9jxyjM4t237QEw1AUF1tDD7Bn2u8fWVb2F12h7a1yV KhXauSkew== X-Received: by 2002:a05:6a21:70c8:b0:3bf:c07b:a9a7 with SMTP id adf61e73a8af0-3c03e5468fdmr1002877637.50.1783117712601; Fri, 03 Jul 2026 15:28:32 -0700 (PDT) Received: from ryzen.lan ([2601:644:8000:7a86::e34]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c9e91b09942sm2967794a12.17.2026.07.03.15.28.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Jul 2026 15:28:31 -0700 (PDT) From: Rosen Penev To: linux-kernel@vger.kernel.org Cc: Srinivas Kandagatla , rafal@milecki.pl Subject: [PATCH] nvmem: brcm_nvram: reject empty NVRAM partition Date: Fri, 3 Jul 2026 15:28:30 -0700 Message-ID: <20260703222830.408764-1-rosenp@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If the partition is completely erased (all padding bytes), the trimming loop reduces data_len to 0. devm_kzalloc(dev, 0, GFP_KERNEL) returns ZERO_SIZE_PTR ((void *)16), which is non-NULL and bypasses the NULL check. The subsequent cast of priv->data to struct brcm_nvram_header * and dereference of header->magic causes a page fault on address 0x10. Reject data_len smaller than the header before allocating. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- drivers/nvmem/brcm_nvram.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c index a29183ecd3e0..9f77aee37121 100644 --- a/drivers/nvmem/brcm_nvram.c +++ b/drivers/nvmem/brcm_nvram.c @@ -84,6 +84,11 @@ static int brcm_nvram_copy_data(struct brcm_nvram *priv, struct platform_device } WARN(priv->data_len > SZ_128K, "Unexpected (big) NVRAM size: %zu B\n", priv->data_len); + if (priv->data_len < sizeof(struct brcm_nvram_header)) { + dev_err(priv->dev, "NVRAM data too small (%zu)\n", priv->data_len); + return -EINVAL; + } + priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL); if (!priv->data) return -ENOMEM; -- 2.55.0