Skip to content

Commit

Permalink
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
Browse files Browse the repository at this point in the history
[ Upstream commit 3ab8c5e ]

The nvmem interface supports variable buffer sizes, while the regmap
interface operates with fixed-size storage. If an nvmem client uses a
buffer size less than 4 bytes, regmap_read will write out of bounds
as it expects the buffer to point at an unsigned int.

Fix this by using an intermediary unsigned int to hold the value.

Fixes: fadfd09 ("rtc: pcf85063: add nvram support")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.kernel.org/r/20241218-rtc-pcf85063-stack-corruption-v1-1-12fd0ee0f046@pengutronix.de
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
  • Loading branch information
Oleksij Rempel authored and Greg Kroah-Hartman committed Mar 13, 2025
1 parent 7e14ab3 commit 6f2a8ca
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion drivers/rtc/rtc-pcf85063.c
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops_alarm = {
static int pcf85063_nvmem_read(void *priv, unsigned int offset,
void *val, size_t bytes)
{
return regmap_read(priv, PCF85063_REG_RAM, val);
unsigned int tmp;
int ret;

ret = regmap_read(priv, PCF85063_REG_RAM, &tmp);
if (ret < 0)
return ret;

*(u8 *)val = tmp;

return 0;
}

static int pcf85063_nvmem_write(void *priv, unsigned int offset,
Expand Down

0 comments on commit 6f2a8ca

Please sign in to comment.