[PATCH v2 0/2] nvmem: validate access ranges and fix SPRD reads

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@xxxxxxxxxxx>

Patch 1 adds a device-size bounds check to the two nvmem core read/write
functions, so an out-of-range request is rejected before it reaches a
provider. v1 open-coded this check in the sprd driver; this version puts
it in the core instead.

Patch 2 fixes sprd_efuse_read(), which reads one four-byte block but
copies the caller's full length from that stack variable, and never
advances past the first block. Its provider-side range check is removed
in favour of patch 1, so patch 2 should be applied after patch 1:
without the core check an out-of-range in-kernel request would let the
new block loop read past the eFuse region.

Both patches are compile-tested only. No Spreadtrum eFuse hardware was
available for runtime testing. The bounds check intentionally permits a
zero-length access at offset == size and rejects all ranges extending
past the device size.

Link for v1:https://lore.kernel.org/all/20260904003815.462352-1-sanman.pradhan@xxxxxxx/

Sanman Pradhan (2):
  nvmem: core: reject reads and writes beyond the device size
  nvmem: sprd: fix out-of-bounds read in sprd_efuse_read()

 drivers/nvmem/core.c       |  6 ++++++
 drivers/nvmem/sprd-efuse.c | 17 ++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)


base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.34.1