linux-kernel - [PATCH] nvmem: meson-mx-efuse: fix reading from an offset other than 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 15 Dec 2017 13:42:04 +0000
From:   srinivas.kandagatla@...aro.org
To:     gregkh@...uxfoundation.org
Cc:     linux-kernel@...r.kernel.org, srinivas.kandagatla@...aro.org,
        Martin Blumenstingl <martin.blumenstingl@...glemail.com>
Subject: [PATCH] nvmem: meson-mx-efuse: fix reading from an offset other than 0

From: Martin Blumenstingl <martin.blumenstingl@...glemail.com>

meson_mx_efuse_read calculates the address internal to the eFuse based
on the offset and the word size. This works fine with any given offset.
However, the offset is also included when writing to the output buffer.
This means that reading 4 bytes at offset 500 tries to write beyond the
array allocated by the nvmem core as it wants to write the 4 bytes to
"buffer address + offset (500)".
This issue did not show up in the previous tests since no driver uses
any value from the eFuse yet and reading the eFuse via sysfs simply
reads the whole eFuse, starting at offset 0.

Fix this by only including the offset in the internal address
calculation.

Fixes: 8caef1fa9176 ("nvmem: add a driver for the Amlogic Meson6/Meson8/Meson8b SoCs")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@...glemail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
---
Hi Greg, 

Can you pick this patch up for next possible RC cycle.

Thanks,
Srini

 drivers/nvmem/meson-mx-efuse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvmem/meson-mx-efuse.c b/drivers/nvmem/meson-mx-efuse.c
index a346b4923550..41d3a3c1104e 100644
--- a/drivers/nvmem/meson-mx-efuse.c
+++ b/drivers/nvmem/meson-mx-efuse.c
@@ -156,8 +156,8 @@ static int meson_mx_efuse_read(void *context, unsigned int offset,
 				 MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE,
 				 MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE);

-	for (i = offset; i < offset + bytes; i += efuse->config.word_size) {
-		addr = i / efuse->config.word_size;
+	for (i = 0; i < bytes; i += efuse->config.word_size) {
+		addr = (offset + i) / efuse->config.word_size;

 		err = meson_mx_efuse_read_addr(efuse, addr, &tmp);
 		if (err)
-- 
2.15.0