nvmem: fix out-of-bounds reboot-mode write
Subsystems (2)
v3 cover nvmem: fix out-of-bounds reboot-mode write
Hi all,
These patches fix a small out-of-bounds write when using the nvmem-reboot-mode driver on Qualcomm SA8775P, such as by executing "reboot bootloader" in a shell. Relevant error log:
BUG: KASAN: slab-out-of-bounds in nvmem_cell_prepare_write_buffer+0x144/0x47c Write of size 4 at addr ffff19dd8e1a37a0 by task systemd-shutdow/1 Hardware name: Qualcomm SA8775P Ride (DT) Call trace: nvmem_cell_prepare_write_buffer nvmem_cell_write nvmem_reboot_mode_write The buggy address is located 0 bytes inside of allocated 1-byte region
This problem manifested because the devicetree file sa8775p-pmics.dtsi specifies its reboot-mode cell with "reg = <0x48 0x1>" and so expects the reboot mode write to only be 1 byte rather than 4. Other in-tree devicetrees that seem likely affected include pmk8350 and pmk8550.
These changes add the missing bounds check to nvmem_cell_write and make nvmem-reboot-mode able to only write as many bytes as it needs to.
v2:
- Added missing function definition for CONFIG_NVMEM=n
v3:
- Accepted suggestion for changing nvmem_cell_write bounds check
---
Jennifer Berringer (3):
nvmem: core: improve range check for nvmem_cell_write()
nvmem: core: add nvmem_cell_write_variable_u32()
power: reset: nvmem-reboot-mode: fix write for small cells
drivers/nvmem/core.c | 26 +++++++++++++++++++++++++ drivers/power/reset/nvmem-reboot-mode.c | 2 +- include/linux/nvmem-consumer.h | 6 ++++++ 3 files changed, 33 insertions(+), 1 deletion(-)
base-commit: 98f7e32f20d28ec452afb208f9cffc08448a2652
Signature · 1 line
2.46.2
PATCH v3 1/3 nvmem: core: improve range check for nvmem_cell_write()
When __nvmem_cell_entry_write() is called for an nvmem cell that does not need bit shifting, it requires that the len parameter exactly matches the nvmem cell size. However, when the nvmem cell has a nonzero bit_offset, it was skipping this check.
Accepting values of len larger than the cell size results in nvmem_cell_prepare_write_buffer() trying to write past the end of a heap buffer that it allocates. Add a check to avoid that problem and instead return -EINVAL when len doesn't match the number of bits expected by the nvmem cell when bit_offset is nonzero.
This check uses cell->nbits in order to allow providing the smaller size to cells that are shifted into another byte by bit_offset. For example, a cell with nbits=8 and nonzero bit_offset would have bytes=2 but should accept a 1-byte write here, although no current callers depend on this.
--- drivers/nvmem/core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvmem/core.c +2 -0
@@ -1780,6 +1780,8 @@ static int __nvmem_cell_entry_write(struct nvmem_cell_entry *cell, void *buf, sireturn -EINVAL ;if (cell->bit_offset || cell->nbits) { +if (len !=BITS_TO_BYTES (cell->nbits) && len != cell->bytes) +return -EINVAL ; buf =nvmem_cell_prepare_write_buffer (cell, buf, len);if (IS_ERR (buf))return PTR_ERR (buf);
Signature · 1 line
2.46.2
PATCH v3 2/3 nvmem: core: add nvmem_cell_write_variable_u32()
In reply to Jennifer BerringerThis function allows nvmem consumers to write values of different sizes (1-4 bytes) to an nvmem cell without knowing the exact size, akin to a write counterpart to nvmem_cell_read_variable_le_32(). It discards the higher order bytes of the passed u32 value based on CPU endianness as necessary before writing to a cell smaller than 4 bytes.
--- drivers/nvmem/core.c | 24 ++++++++++++++++++++++++ include/linux/nvmem-consumer.h | 6 ++++++ 2 files changed, 30 insertions(+)
drivers/nvmem/core.c +24 -0
@@ -1815,6 +1815,30 @@ int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len)EXPORT_SYMBOL_GPL (nvmem_cell_write); +/** +* nvmem_cell_write_variable_u32() - Write up to 32-bits of data as a host-endian number +* +* @cell: nvmem cell to be written. +* @val: Value to be written which may be truncated. +* +* Return: length of bytes written or negative on failure. +*/ +int nvmem_cell_write_variable_u32 (struct nvmem_cell *cell,u32 val) +{ +struct nvmem_cell_entry *entry = cell->entry; +u8 *buf = (u8 *) &val; + +if (!entry || entry->bytes >sizeof (u32)) +return -EINVAL ; + +#ifdef __BIG_ENDIAN + buf +=sizeof (u32) - entry->bytes; +#endif + +return __nvmem_cell_entry_write (entry, buf, entry->bytes); +} +EXPORT_SYMBOL_GPL (nvmem_cell_write_variable_u32); +static int nvmem_cell_read_common (struct device *dev,const char *cell_id,void *val,size_t count) {
include/linux/nvmem-consumer.h +6 -0
@@ -56,6 +56,7 @@ void nvmem_cell_put(struct nvmem_cell *cell);void devm_nvmem_cell_put (struct device *dev,struct nvmem_cell *cell);void *nvmem_cell_read (struct nvmem_cell *cell,size_t *len);int nvmem_cell_write (struct nvmem_cell *cell,void *buf,size_t len); +int nvmem_cell_write_variable_u32 (struct nvmem_cell *cell,u32 val);int nvmem_cell_read_u8 (struct device *dev,const char *cell_id,u8 *val);int nvmem_cell_read_u16 (struct device *dev,const char *cell_id,u16 *val);int nvmem_cell_read_u32 (struct device *dev,const char *cell_id,u32 *val);
@@ -128,6 +129,11 @@ static inline int nvmem_cell_write(struct nvmem_cell *cell,return -EOPNOTSUPP ; } +static inline int nvmem_cell_write_variable_u32 (struct nvmem_cell *cell,u32 val) +{ +return -EOPNOTSUPP ; +} +static inline int nvmem_cell_read_u8 (struct device *dev,const char *cell_id,u8 *val) {
Signature · 1 line
2.46.2
Re: [PATCH v3 2/3] nvmem: core: add nvmem_cell_write_variable_u32()
Thanks for the patch,
Quoted 20 lines · Jennifer Berringer
This function allows nvmem consumers to write values of different sizes (1-4 bytes) to an nvmem cell without knowing the exact size, akin to a write counterpart to
nvmem_cell_read_variable_le_32(). It discards the higher order bytes of the passed u32 value based on CPU endianness as necessary before writing to a cell smaller than 4 bytes.Signed-off-by Jennifer Berringer <[email protected]>--- drivers/nvmem/core.c | 24 ++++++++++++++++++++++++ include/linux/nvmem-consumer.h | 6 ++++++ 2 files changed, 30 insertions(+)drivers/nvmem/core.c +0
-0@@ -1815,6 +1815,30 @@ int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len)EXPORT_SYMBOL_GPL (nvmem_cell_write);
drivers/nvmem/core.c int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len) · line 1827
Quoted 10 lines
drivers/nvmem/core.c +9
-0+/** +* nvmem_cell_write_variable_u32() - Write up to 32-bits of data as a host-endian number +* +* @cell: nvmem cell to be written. +* @val: Value to be written which may be truncated. +* +* Return: length of bytes written or negative on failure. +*/ +int nvmem_cell_write_variable_u32 (struct nvmem_cell *cell,u32 val)
This new API is confusing, as writing to cell should in the same order of the data. Doing any data manipulation within the api is confusing to users.
If the intention is to know the size of cell before writing, then best way to address this is to provide the cell size visibility to the consumer.
--srini
Quoted 43 lines
drivers/nvmem/core.c +15
-0+{ +struct nvmem_cell_entry *entry = cell->entry; +u8 *buf = (u8 *) &val; + +if (!entry || entry->bytes >sizeof (u32)) +return -EINVAL ; + +#ifdef __BIG_ENDIAN + buf +=sizeof (u32) - entry->bytes; +#endif + +return __nvmem_cell_entry_write (entry, buf, entry->bytes); +} +EXPORT_SYMBOL_GPL (nvmem_cell_write_variable_u32); + static int nvmem_cell_read_common(struct device *dev, const char *cell_id,void *val, size_t count) {include/linux/nvmem-consumer.h +6
-0@@ -56,6 +56,7 @@ void nvmem_cell_put(struct nvmem_cell *cell);void devm_nvmem_cell_put (struct device *dev,struct nvmem_cell *cell);void *nvmem_cell_read (struct nvmem_cell *cell,size_t *len);int nvmem_cell_write (struct nvmem_cell *cell,void *buf,size_t len); +int nvmem_cell_write_variable_u32 (struct nvmem_cell *cell,u32 val);int nvmem_cell_read_u8 (struct device *dev,const char *cell_id,u8 *val);int nvmem_cell_read_u16 (struct device *dev,const char *cell_id,u16 *val);int nvmem_cell_read_u32 (struct device *dev,const char *cell_id,u32 *val);@@ -128,6 +129,11 @@ static inline int nvmem_cell_write(struct nvmem_cell *cell,return -EOPNOTSUPP ; } +static inline int nvmem_cell_write_variable_u32 (struct nvmem_cell *cell,u32 val) +{ +return -EOPNOTSUPP ; +} +static inline int nvmem_cell_read_u8 (struct device *dev,const char *cell_id,u8 *val) {
Re: [PATCH v3 2/3] nvmem: core: add nvmem_cell_write_variable_u32()
Thanks for the feedback and for accepting my first patch.
Quoted 10 lines · Srinivas Kandagatla
Quoted 9 lines
+ *
nvmem_cell_write_variable_u32()- Write up to 32-bits of data as a host-endian number+ *
+ * @cell: nvmem cell to be written.
+ * @val: Value to be written which may be truncated.
+ *
+ * Return: length of bytes written or negative on failure.
+ */
+intnvmem_cell_write_variable_u32(struct nvmem_cell *cell, u32 val)
Quoted 5 lines
This new API is confusing, as writing to cell should in the same order of the data. Doing any data manipulation within the api is confusing to users.
If the intention is to know the size of cell before writing, then best way to address this is to provide the cell size visibility to the consumer.
--srini
My intention was to mirror the existing functions in this file, hoping that would make it less confusing rather than more. nvmem_cell_read_variable_le_u32() already similarly has consumers accessing the contents of a cell without knowing its size, silently filling any bytes not read with zero. The function I add doesn't change the order of the bytes. The existing read_variable_le functions (in contrast) byte swap from little-endian to the CPU's endianness and indicate this in the function name. Otherwise, I believe the function I add here is what would be expected from a write equivalent. Its return value also gives the caller the actual cell size upon success.
The only manipulation done to the data here is truncating to ignore the highest-order bytes. This behavior should match the below example unless the size is 3 bytes, which my patch should handle but the below example can't.
if (entry->bytes == sizeof(u32)) {
return __nvmem_cell_entry_write(entry, &val, sizeof(u32));
} else if (entry->bytes == sizeof(u16)) {
u16 val_16 = (u16) val;
return __nvmem_cell_entry_write(entry, &val_16, sizeof(u16));
} else if (entry->bytes == sizeof(u8)) {
u8 val_8 = (u8) val;
return __nvmem_cell_entry_write(entry, &val_8, sizeof(u8));
} else {
return -EINVAL;
}Still, if you prefer, I can send new patches that add a function to get the cell size and put any truncation behavior needed by nvmem-reboot-mode into that source file instead.
Re: [PATCH v3 2/3] nvmem: core: add nvmem_cell_write_variable_u32()
Quoted 13 lines · Jennifer Berringer
Thanks for the feedback and for accepting my first patch.
Quoted 10 lines · Srinivas Kandagatla
Quoted 9 lines
+ *
nvmem_cell_write_variable_u32()- Write up to 32-bits of data as a host-endian number+ *
+ * @cell: nvmem cell to be written.
+ * @val: Value to be written which may be truncated.
+ *
+ * Return: length of bytes written or negative on failure.
+ */
+intnvmem_cell_write_variable_u32(struct nvmem_cell *cell, u32 val)
Quoted 8 lines
Quoted 5 lines
This new API is confusing, as writing to cell should in the same order of the data. Doing any data manipulation within the api is confusing to users.
If the intention is to know the size of cell before writing, then best way to address this is to provide the cell size visibility to the consumer.
--srini
My intention was to mirror the existing functions in this file, hoping that would make it less confusing rather than more.
nvmem_cell_read_variable_le_u32()already similarly has consumers accessing the contents of a cell without knowing its size, silently filling any bytes not read with zero. The function I add doesn't change the order of the bytes. The existingread_variable_lefunctions (in contrast) byte swap from little-endian to the CPU's endianness and indicate this in the function name. Otherwise, I believe the function I add here is what would be expected from a write equivalent. Its return value also gives the caller the actual cell size upon success.
Writes happen in the order of data that is provided, and read in the same order that is stored in NVMEM. Reading from nvmem storage can be translated into whatever order that consumer wants which is what the read helpers are doing. On the other hand writes should be written in the same order as its received.
Note that the order in which EEPROM stores data might not be the same order as CPU.
Adding Endianess in writing to a common code is a problem. If you are certain that the NVMEM needs particular order(le/be) then either convert (cpu_to_le/cpu_to_be) the data before it hits write call.
Quoted 14 lines
The only manipulation done to the data here is truncating to ignore the highest-order bytes. This behavior should match the below example unless the size is 3 bytes, which my patch should handle but the below example can't.
if (entry->bytes == sizeof(u32)) { return __nvmem_cell_entry_write(entry, &val, sizeof(u32)); } else if (entry->bytes == sizeof(u16)) { u16 val_16 = (u16) val; return __nvmem_cell_entry_write(entry, &val_16, sizeof(u16)); } else if (entry->bytes == sizeof(u8)) { u8 val_8 = (u8) val; return __nvmem_cell_entry_write(entry, &val_8, sizeof(u8)); } else { return -EINVAL; }
Quoted 1 line
Still, if you prefer, I can send new patches that add a function to get the cell size and put any truncation behavior needed by nvmem-reboot-mode into that source file instead.
there are two things, one is the variable size u32, other is changing the endainess. Am happy with the former one as long as the consumer is taking care of order.
But the later one is No, as explained.
--srini
Quoted 1 line
PATCH v3 3/3 power: reset: nvmem-reboot-mode: fix write for small cells
In reply to Jennifer BerringerSome devices, such as Qualcomm sa8775p, have an nvmem reboot mode cell that is smaller than 32 bits, which resulted in nvmem_reboot_mode_write() failing. Using nvmem_cell_write_variable_u32() fixes this by writing only the least-significant byte of the magic value when the size specified in device tree is only one byte.
--- drivers/power/reset/nvmem-reboot-mode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/reset/nvmem-reboot-mode.c +1 -1
@@ -24,7 +24,7 @@ static int nvmem_reboot_mode_write(struct reboot_mode_driver *reboot, nvmem_rbm = container_of(reboot, struct nvmem_reboot_mode, reboot); - ret =nvmem_cell_write (nvmem_rbm->cell, &magic,sizeof (magic)); + ret =nvmem_cell_write_variable_u32 (nvmem_rbm->cell, magic);if (ret <0 )dev_err (reboot->dev,"update reboot mode bits failed\n" );
Signature · 1 line
2.46.2
Re: [PATCH v3 3/3] power: reset: nvmem-reboot-mode: fix write for small cells
Hi,
Quoted 8 lines · Jennifer Berringer
Some devices, such as Qualcomm sa8775p, have an nvmem reboot mode cell that is smaller than 32 bits, which resulted in
nvmem_reboot_mode_write()failing. Usingnvmem_cell_write_variable_u32()fixes this by writing only the least-significant byte of the magic value when the size specified in device tree is only one byte.Signed-off-by Jennifer Berringer <[email protected]>---
-- Sebastian
Quoted 20 lines
drivers/power/reset/nvmem-reboot-mode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/power/reset/nvmem-reboot-mode.c +1
-1@@ -24,7 +24,7 @@ static int nvmem_reboot_mode_write(struct reboot_mode_driver *reboot, nvmem_rbm = container_of(reboot, struct nvmem_reboot_mode, reboot); - ret =nvmem_cell_write (nvmem_rbm->cell, &magic,sizeof (magic)); + ret =nvmem_cell_write_variable_u32 (nvmem_rbm->cell, magic);if (ret <0 )dev_err (reboot->dev,"update reboot mode bits failed\n" );Signature · 1 line
2.46.2
Srinivas Kandagatla
AppliedRe: (subset) [PATCH v3 0/3] nvmem: fix out-of-bounds reboot-mode write
In reply to Jennifer BerringerQuoted 14 lines · Jennifer Berringer
These patches fix a small out-of-bounds write when using the nvmem-reboot-mode driver on Qualcomm SA8775P, such as by executing "reboot bootloader" in a shell. Relevant error log:
BUG: KASAN: slab-out-of-bounds in nvmem_cell_prepare_write_buffer+0x144/0x47c Write of size 4 at addr ffff19dd8e1a37a0 by task systemd-shutdow/1 Hardware name: Qualcomm SA8775P Ride (DT) Call trace: nvmem_cell_prepare_write_buffer nvmem_cell_write nvmem_reboot_mode_write The buggy address is located 0 bytes inside of allocated 1-byte region
Quoted 1 line
[...]
Applied, thanks!
[1/3] nvmem: core: improve range check for nvmem_cell_write()
commit: 27a3485271ed3e81dec1e51460dc671dae387a2a
Best regards,
Signature · 1 line
Srinivas Kandagatla <[email protected]>