[PATCH] nvmem: brcm_nvram: validate cached NVRAM length

[Pengpeng Hou]

The cached-content conversion stops at the partition padding.  Therefore,
data_len may be smaller than nvmem_size.  brcm_nvram_parse() checks
header->len against nvmem_size, then passes that length to
brcm_nvram_add_cells(), which temporarily writes data[len - 1] and parses
NUL-separated entries.

A corrupted header can declare a length that fits the MMIO resource but
exceeds the cached allocation.  Also reject a cached object that is too
small for the header, and reject declared lengths shorter than the header.

Validate the declaration against data_len, which bounds the parsed object.

Fixes: 1e37bf84afac ("nvmem: brcm_nvram: store a copy of NVRAM content")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/nvmem/brcm_nvram.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
index aaa6537798bf..4701772cfa47 100644
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -181,15 +181,21 @@ static int brcm_nvram_parse(struct brcm_nvram *priv)
 	size_t len;
 	int err;
 
+	if (priv->data_len < sizeof(*header)) {
+		dev_err(dev, "NVRAM content (%zu) is smaller than header (%zu)\n",
+			priv->data_len, sizeof(*header));
+		return -EINVAL;
+	}
+
 	if (memcmp(header->magic, NVRAM_MAGIC, 4)) {
 		dev_err(dev, "Invalid NVRAM magic\n");
 		return -EINVAL;
 	}
 
 	len = le32_to_cpu(header->len);
-	if (len > priv->nvmem_size) {
-		dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len,
-			priv->nvmem_size);
+	if (len < sizeof(*header) || len > priv->data_len) {
+		dev_err(dev, "NVRAM length (%zu) is outside cached content (%zu)\n",
+			len, priv->data_len);
 		return -EINVAL;
 	}
 
-- 
2.43.0