[PATCH v2 1/2] nvmem: core: reject reads and writes beyond the device size

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@xxxxxxxxxxx>

nvmem_reg_read() and nvmem_reg_write() pass the requested offset and
length to the provider callbacks without checking them against the
device size. The sysfs binary attribute is bounded by its size, but the
in-kernel device and cell APIs are not, so a caller can request a range
that extends past the end of the device.

Add a bounds check to both functions so out-of-range requests are
rejected before keepout processing or provider access, rather than
relying on each provider to validate. The subtraction-based test avoids
an offset + bytes overflow.

Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers")
Suggested-by: Srinivas Kandagatla <srini@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Sanman Pradhan <psanman@xxxxxxxxxxx>
---

Changes in v2:
- New patch: add the range check in the nvmem core instead of the sprd
  provider.

Compile-tested only.

 drivers/nvmem/core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 0556d140170a4..ca90b24d73675 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -154,6 +154,9 @@ static int nvmem_access_with_keepouts(struct nvmem_device *nvmem,
 static int nvmem_reg_read(struct nvmem_device *nvmem, unsigned int offset,
 			  void *val, size_t bytes)
 {
+	if (offset > nvmem->size || bytes > nvmem->size - offset)
+		return -ERANGE;
+
 	if (!nvmem->nkeepout)
 		return __nvmem_reg_read(nvmem, offset, val, bytes);
 
@@ -163,6 +166,9 @@ static int nvmem_reg_read(struct nvmem_device *nvmem, unsigned int offset,
 static int nvmem_reg_write(struct nvmem_device *nvmem, unsigned int offset,
 			   void *val, size_t bytes)
 {
+	if (offset > nvmem->size || bytes > nvmem->size - offset)
+		return -ERANGE;
+
 	if (!nvmem->nkeepout)
 		return __nvmem_reg_write(nvmem, offset, val, bytes);
 
-- 
2.34.1