Re: [PATCH] nvmem: core: Fix OOB read for bit offsets of more than one byte

[Dmitry Sinyavin]

Hi Janne,

Thanks for the patch. I independently ran into this bug while testing
Qualcomm MDM9607 TSENS calibration. I tested the exact change against the
current NVMEM for-fixes branch at cee9395acd80.

Without the patch, a focused KUnit case with a 26-bit offset returned the
expected value but produced three KASAN out-of-bounds reports. On the
MF283V, the unmodified kernel produced exactly seven reports from four
TSENS calibration cells, matching the accesses predicted from their bit
offsets.

With the patch, the focused test and a 16,384-case extraction matrix pass
under KASAN. A hardware A/B test using otherwise identical Linux 6.18.44
kernels produced no KASAN report with the fix, and all five TSENS zones
reported plausible temperatures between 36 and 38 degrees Celsius.

Tested-by: Dmitry Sinyavin <sinyavin@xxxxxxxxx>

I could not find the patch in the current NVMEM for-fixes or for-next
branches. Are you planning to send a v2 with the stable Cc requested in
the earlier reply? I can send the KUnit coverage separately if useful.

Regards,
Dmitry