From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80BA125F994 for ; Fri, 3 Jul 2026 22:28:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783117735; cv=none; b=lFRgeazwb41G5qAJ+mEcJSa0eEcqEqi7HiHb1I9B4EGENIhpI/ARMxvaRthSA1t9lkNsPyEMwbXcIa/99YVTrmDuWiVIm+Q3S5IRJkae9gRijvifA6ZTYgwiTy8xwdK1rUVv+8HIkCZPYJYPo221s2a0Cx239wGIn9JABZniuw0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783117735; c=relaxed/simple; bh=AAjWP/guUoMWhHyZQR9vVrBTKhb2bUgSAflAX/wOH04=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=IFmCnQAVA/LITnRH8Bo2hJwPEB8vhnOlMGF8tk7oypz57zK2upu4A8c4Qj2qrrPiv1CDeFHSkeRHX9uD8Xzujwi1X9SuVD+nmimwkO+Kyu8FBXOW+joIaidg0vNFM4y+nugpMdGvxVkBi1dcFXZpQW2Z32Tj2wIF3p825axHSFE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sA+xRBFy; arc=none smtp.client-ip=209.85.210.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sA+xRBFy" Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-847a52edeb2so778162b3a.0 for ; Fri, 03 Jul 2026 15:28:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783117734; x=1783722534; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=vVKLbyDqhQnTaAgzHcN3FdVyr/f8NhXQMDso/Ejy6N8=; b=sA+xRBFyhaPtbvhzRkfC2U/MFuYetCsHVxjTxbOJfVPOn8VKN0Px3PUDoqYzmkJ4Vy fCN8aNGxfeADMtTPkSLhL2fw0dGSdDeCJzY6DiUUhrLgPGodbRJZz3B53BWbO+p5Uj2u Y/EXosHAYE8GeXrwjNk2+9DmLDFuPdaNdAX6Gp6Y5jWldNkD9Mz8Ba5yzSluigczkYup Q1WG6U2jxNHzZJjLZVOFUZWZocsKxmTomwi3K2pW5lc57Tcoq9/tHGTwUX7WlAbH1XW/ OJAQ8U0qnzwlIHVgeaxQa0IRCrWngZyMCSGmeiPI1hzBy7n3ec8vNEoq0HWgkMTiuMJH Flrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783117734; x=1783722534; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=vVKLbyDqhQnTaAgzHcN3FdVyr/f8NhXQMDso/Ejy6N8=; b=m4oCihI1WJbDgRLYlqlRwhyBbX+PWad+NK958q8dgcOXBj0C13RWuTa+HYbm9Paet+ 1ZIIhoY3+jVpKFE0GV23goEs8QgeS2unH7InVSv1Pv+UJ5F90RPwQEmPd/CK21HjUTwR 6+7YVBjz/gDYMdkWxcqgnNHd7lepsSmR8ZAAiIBYvri8Sk2QFslA4wvPaoQAVZFo3Lnd NU7fHgyNG+dEs1I4WfjoGLfK3GTzUEq3NvcwahTODeLqXSLx53Sx7J8WjxyVo3vS9vlN oAx9ChHk1cd3TYHuKGJ+n9kw3TPMHqBIbmIxbXwTr4SVk7sswWXIIdwMW2S9j1uVglPl tcWQ== X-Gm-Message-State: AOJu0Yy7kKzFswOo20Wguh4Jw3J9fuIhfvJ95GIe5wVh9DA4H2oSyx5G uWg5KWt7Z0cz8aGimC3ICSaMVd2X2NKE5JJ0CqX2OvVTQ8AmevsXasYZgr7aVg== X-Gm-Gg: AfdE7cmPZ+6qCBmq8DfD8GHJ74w127EH3Y7YCRc2ew49TvzOdyq+/WKJjBH1cs32bAq JKy5gHBe04+0Aczak3zE2hs2MyZZHm4zxNDHOV96LaOBqQ7eVKKw7v3uqahl8Aci4WuCYif3yW5 WSTxdEVnyFXUj9Xd563yPXvrbO48cPwRHbJva/K1rGzT+bLhVQjePg0g2Qbxz6KvWYTEpxbmoHp +PvGSqoLp6sdge+FyOwCPg7MTJvtz7iPJZ5Inngi/JeeihE/IOqHigDOlLbdt2yeUph4cxtVesA 0KEEAXnDRcEejVmLsv+TIRMZ5TY2WSSBZ2KX9a5CKyLdj0k6SsKcRMGKwtUVZshk4Mqxv2j157t ZMwu2DJFeM+s2cPnLtde5kZdhNrlrG9s3Ih0XZCDNC29p/J2bUJL6b/+Q9n9FlRfcM1fIGoVL8N Fxts8V4KLRg3AQe7weMQDJIZ3ZsdBaGxJT6BrWmxceA2uXB9LIZCS9Did2nxAfR6ldeJiO1BjX7 4LFGQUSSg== X-Received: by 2002:a05:6a00:430a:b0:847:980d:71f8 with SMTP id d2e1a72fcca58-847f6dc8ca8mr1049512b3a.15.1783117733621; Fri, 03 Jul 2026 15:28:53 -0700 (PDT) Received: from ryzen.lan ([2601:644:8000:7a86::e34]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6b64555sm389895b3a.8.2026.07.03.15.28.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Jul 2026 15:28:53 -0700 (PDT) From: Rosen Penev To: linux-kernel@vger.kernel.org Cc: Srinivas Kandagatla , rafal@milecki.pl Subject: [PATCH] nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data Date: Fri, 3 Jul 2026 15:28:52 -0700 Message-ID: <20260703222852.410370-1-rosenp@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The length check in brcm_nvram_parse() validated header->len against priv->nvmem_size (the full partition size) instead of priv->data_len (the actual allocated data buffer). A malformed flash partition with header->len between the two would pass the check, causing brcm_nvram_add_cells() to read and write priv->data[len - 1] beyond the heap allocation. Also add a minimum bound: len < sizeof(*header) could underflow the data[len - 1] access. Fix both bounds by rejecting len outside [sizeof(*header), priv->data_len]. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- drivers/nvmem/brcm_nvram.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c index aaa6537798bf..a29183ecd3e0 100644 --- a/drivers/nvmem/brcm_nvram.c +++ b/drivers/nvmem/brcm_nvram.c @@ -187,9 +187,13 @@ static int brcm_nvram_parse(struct brcm_nvram *priv) } len = le32_to_cpu(header->len); - if (len > priv->nvmem_size) { - dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len, - priv->nvmem_size); + if (len < sizeof(*header)) { + dev_err(dev, "NVRAM length (%zd) too small\n", len); + return -EINVAL; + } + if (len > priv->data_len) { + dev_err(dev, "NVRAM length (%zd) exceeds data size (%zd)\n", len, + priv->data_len); return -EINVAL; } -- 2.55.0