[PATCH] nvmem: sprd: fix out-of-bounds read in sprd_efuse_read()

["Pradhan, Sanman" <sanman.pradhan@hpe.com>]

From: Sanman Pradhan <psanman@juniper.net>

sprd_efuse_read() reads a single four-byte block into the stack
variable "data" and then copies the caller's full "bytes" length from
it. The NVMEM core does not split the request: word_size and stride are
both 1, so bin_attr_nvmem_read() passes the length through unchanged, and
__nvmem_cell_read() reads cell->raw_len in one call.

Reading the whole device (96 bytes for ums312_data) therefore issues a
single 96-byte memcpy() from a 32-bit stack object, copying 92 bytes of
adjacent stack memory into the buffer returned to the reader. The sysfs
nvmem file is world-readable, so an unprivileged read is enough to
trigger it; the same over-read is reachable through any DT cell wider
than four bytes. Only the first block is ever read, so the returned data
is wrong as well: blocks 1..N are never fetched.

Read and copy one block at a time, capping each copy to the bytes left
in the block so it can never exceed sizeof(data), and account for an
unaligned starting offset. The NVMEM core does not validate
offset + bytes against the device size, so also reject ranges outside the
normal eFuse area before issuing any MMIO read.

Fixes: 096030e7f449 ("nvmem: sprd: Add Spreadtrum SoCs eFuse support")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---

Compile-tested only (NVMEM_SPRD_EFUSE, ARCH_SPRD || COMPILE_TEST); no
Spreadtrum eFuse hardware available for runtime testing.

 drivers/nvmem/sprd-efuse.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/nvmem/sprd-efuse.c b/drivers/nvmem/sprd-efuse.c
index 1a7e4e5d8b86c..0ad94245094b3 100644
--- a/drivers/nvmem/sprd-efuse.c
+++ b/drivers/nvmem/sprd-efuse.c
@@ -5,6 +5,7 @@
 #include <linux/delay.h>
 #include <linux/hwspinlock.h>
 #include <linux/io.h>
+#include <linux/minmax.h>
 #include <linux/module.h>
 #include <linux/nvmem-provider.h>
 #include <linux/of.h>
@@ -297,9 +298,14 @@ static int sprd_efuse_read(void *context, u32 offset, void *val, size_t bytes)
 	bool blk_double = efuse->data->blk_double;
 	u32 index = offset / SPRD_EFUSE_BLOCK_WIDTH + efuse->data->blk_offset;
 	u32 blk_offset = (offset % SPRD_EFUSE_BLOCK_WIDTH) * BITS_PER_BYTE;
+	u8 *buf = val;
 	u32 data;
+	size_t size = (size_t)efuse->data->blk_nums * SPRD_EFUSE_BLOCK_WIDTH;
 	int ret;
 
+	if (offset > size || bytes > size - offset)
+		return -EINVAL;
+
 	ret = sprd_efuse_lock(efuse);
 	if (ret)
 		return ret;
@@ -308,10 +314,19 @@ static int sprd_efuse_read(void *context, u32 offset, void *val, size_t bytes)
 	if (ret)
 		goto unlock;
 
-	ret = sprd_efuse_raw_read(efuse, index, &data, blk_double);
-	if (!ret) {
+	while (bytes) {
+		size_t avail = SPRD_EFUSE_BLOCK_WIDTH - blk_offset / BITS_PER_BYTE;
+		size_t count = min_t(size_t, bytes, avail);
+
+		ret = sprd_efuse_raw_read(efuse, index++, &data, blk_double);
+		if (ret)
+			break;
+
 		data >>= blk_offset;
-		memcpy(val, &data, bytes);
+		memcpy(buf, &data, count);
+		buf += count;
+		bytes -= count;
+		blk_offset = 0;
 	}
 
 	clk_disable_unprepare(efuse->clk);

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.34.1