Commit 8679e8b4 authored by John Thomson's avatar John Thomson Committed by Greg Kroah-Hartman

nvmem: u-boot-env: error if NVMEM device is too small

Verify data size before trying to parse it to avoid reading out of
buffer. This could happen in case of problems at MTD level or invalid DT
bindings.
Signed-off-by: default avatarJohn Thomson <git@johnthomson.fastmail.com.au>
Cc: stable <stable@kernel.org>
Fixes: d5542923 ("nvmem: add driver handling U-Boot environment variables")
[rmilecki: simplify commit description & rebase]
Signed-off-by: default avatarRafał Miłecki <rafal@milecki.pl>
Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20240902142510.71096-2-srinivas.kandagatla@linaro.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e8c276d4
...@@ -176,6 +176,13 @@ static int u_boot_env_parse(struct u_boot_env *priv) ...@@ -176,6 +176,13 @@ static int u_boot_env_parse(struct u_boot_env *priv)
data_offset = offsetof(struct u_boot_env_image_broadcom, data); data_offset = offsetof(struct u_boot_env_image_broadcom, data);
break; break;
} }
if (dev_size < data_offset) {
dev_err(dev, "Device too small for u-boot-env\n");
err = -EIO;
goto err_kfree;
}
crc32_addr = (__le32 *)(buf + crc32_offset); crc32_addr = (__le32 *)(buf + crc32_offset);
crc32 = le32_to_cpu(*crc32_addr); crc32 = le32_to_cpu(*crc32_addr);
crc32_data_len = dev_size - crc32_data_offset; crc32_data_len = dev_size - crc32_data_offset;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment