Re: [PATCH] nvmem: core: Fix OOB read for bit offsets of more than one byte

[Srinivas Kandagatla]

On 9/1/25 8:29 AM, Janne Grunau wrote:
> When the bit offset is BITS_PER_BYTE or larger the read position is
> advanced by `bytes_offset`. This is not taken into account in the
> per-byte read loop which still reads `cell->bytes` resulting in an out of
> bounds read of `bytes_offset` bytes. The information read OOB does not
> leak directly as the erroneously read bits are cleared.
> 
> Detected by KASAN while looking for a use-after-free in simplefb.c.
> 
> Fixes: 7a06ef7510779 ("nvmem: core: fix bit offsets of more than one byte")
12 chars sha pl

Missing CC Stable.

> Signed-off-by: Janne Grunau <j@xxxxxxxxxx>
> ---
>  drivers/nvmem/core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 387c88c55259541446901f0e539bbb0dd8c4c3de..19be16943ee66e845860192b8f008539873f6f7f 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -1618,12 +1618,14 @@ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell_entry *cell, void
>  		*p = *b++ >> bit_offset;
>  
>  		/* setup rest of the bytes if any */
> -		for (i = 1; i < cell->bytes; i++) {
> +		for (i = 1; i < (cell->bytes - bytes_offset); i++) {
>  			/* Get bits from next byte and shift them towards msb */
>  			*p++ |= *b << (BITS_PER_BYTE - bit_offset);
>  
>  			*p = *b++ >> bit_offset;
>  		}
> +		/* point to end of the buffer unused bits will be cleared */
> +		p = buf + cell->bytes - 1;
>  	} else if (p != b) {
>  		memmove(p, b, cell->bytes - bytes_offset);
>  		p += cell->bytes - 1;
> 
> ---
> base-commit: 8f5ae30d69d7543eee0d70083daf4de8fe15d585
> change-id: 20250901-nvmem-read-oob-bit-offset-dc1c2f39af6c
> 
> Best regards,