Re: [PATCH] nvmem: core: Fix OOB read for bit offsets of more than one byte

[Janne Grunau <j@jannau.net>]

On Sat, Sep 19, 2026 at 08:56:36PM +0200, Dmitry Sinyavin wrote:
> Hi Janne,
> 
> Thanks for the patch. I independently ran into this bug while testing
> Qualcomm MDM9607 TSENS calibration. I tested the exact change against the
> current NVMEM for-fixes branch at cee9395acd80.
> 
> Without the patch, a focused KUnit case with a 26-bit offset returned the
> expected value but produced three KASAN out-of-bounds reports. On the
> MF283V, the unmodified kernel produced exactly seven reports from four
> TSENS calibration cells, matching the accesses predicted from their bit
> offsets.
> 
> With the patch, the focused test and a 16,384-case extraction matrix pass
> under KASAN. A hardware A/B test using otherwise identical Linux 6.18.44
> kernels produced no KASAN report with the fix, and all five TSENS zones
> reported plausible temperatures between 36 and 38 degrees Celsius.
> 
> Tested-by: Dmitry Sinyavin <sinyavin@gmail.com>
> 
> I could not find the patch in the current NVMEM for-fixes or for-next
> branches. Are you planning to send a v2 with the stable Cc requested in
> the earlier reply? I can send the KUnit coverage separately if useful.

The change is no longer relevant on the systems I discovered the issue
so it got lost and I never sent a v2.

I'll do that shortly with both issues (missing Cc: and long partial
SHA1) fixed and your Tested-by:.

Thanks,

Janne