[PATCH] nvmem: brcm_nvram: don't cut NVRAM data shorter than its header length

[PATCH] nvmem: brcm_nvram: don't cut NVRAM data shorter than its header length

[Rosen Penev]

brcm_nvram_copy_data() sizes the data by stripping trailing bytes that
equal the last byte of the region. NVRAM content itself ends with NUL
bytes, so when the region is padded with 0x00 instead of erased 0xff,
the loop also strips the end of the content. Since
commit a67e2c323a47 ("nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data")
the header length is checked against that size, and such NVRAM is now
rejected. On an ASUS RT-N16, whose CFE pads NVRAM with zeros:

  brcm_nvram 1dff8000.nvram: NVRAM length (2600) exceeds data size (2596)

Extend the data to the length in the header when that fits in the
mapped region. The buffer still covers every byte the parser reads,
so the out-of-bounds protection is kept.

Fixes: a67e2c323a47 ("nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data")
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/nvmem/brcm_nvram.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
index 9f77aee37121..c79d2b081e87 100644
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -66,8 +66,10 @@ static int brcm_nvram_read(void *context, unsigned int offset, void *val,
 
 static int brcm_nvram_copy_data(struct brcm_nvram *priv, struct platform_device *pdev)
 {
+	struct brcm_nvram_header header;
 	struct resource *res;
 	void __iomem *base;
+	size_t len;
 
 	base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
 	if (IS_ERR(base))
@@ -89,6 +91,16 @@ static int brcm_nvram_copy_data(struct brcm_nvram *priv, struct platform_device
 		return -EINVAL;
 	}
 
+	/*
+	 * NVRAM content ends with NUL bytes, so when the padding is 0x00 (as
+	 * written by CFE) the loop above also strips the end of the content.
+	 * Don't cut the data shorter than the length in its header.
+	 */
+	memcpy_fromio(&header, base, sizeof(header));
+	len = le32_to_cpu(header.len);
+	if (len > priv->data_len && len <= priv->nvmem_size)
+		priv->data_len = len;
+
 	priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL);
 	if (!priv->data)
 		return -ENOMEM;
-- 
2.56.0