Re: [PATCH v2] nvmem: core: Fix OOB read for bit offsets of more than one byte

[Srinivas Kandagatla]

On Sun, 20 Sep 2026 18:46:19 +0200, Janne Grunau wrote:
> When the bit offset is BITS_PER_BYTE or larger the read position is
> advanced by `bytes_offset`. This is not taken into account in the
> per-byte read loop which still reads `cell->bytes` resulting in an out of
> bounds read of `bytes_offset` bytes. The information read OOB does not
> leak directly as the erroneously read bits are cleared.
> 
> Detected by KASAN while looking for a use-after-free in simplefb.c.
> 
> [...]

Applied, thanks!

[1/1] nvmem: core: Fix OOB read for bit offsets of more than one byte
      commit: 841ea6e56cc88ec2c28826d62fbab88b234524c5

Best regards,
-- 
Srinivas Kandagatla <srini@xxxxxxxxxx>