Messages in this thread Patch in this message | | | From | Loic Poulain <> | Subject | [PATCH] nvmem: core: Fix possible buffer overflow on nvmem cell write | Date | Tue, 3 Oct 2023 15:13:43 +0200 |
| |
Nothing prevents a nvmem consumer to try writing excessive data to a given nvmem cell (except when bit_offset is 0). The allocated buffer of size 'cell->bytes' in nvmem_cell_prepare_write_buffer may not be large enough to host the copied 'len' bytes.
Signed-off-by: Loic Poulain <loic.poulain@linaro.org> --- drivers/nvmem/core.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index eaf6a3fe8ca6..0b27ab3b3b86 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1654,6 +1654,9 @@ static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell, int i, rc, nbits, bit_offset = cell->bit_offset; u8 v, *p, *buf, *b, pbyte, pbits; + if (len > cell->bytes) + return ERR_PTR(-EINVAL); + nbits = cell->nbits; buf = kzalloc(cell->bytes, GFP_KERNEL); if (!buf) -- 2.34.1
| |