lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 26 Feb 2021 16:26:03 -0800
From:   Douglas Anderson <>
To:     Rob Clark <>,
        Jordan Crouse <>
Cc:     Niklas Cassel <>,
        Ulf Hansson <>,
        Bjorn Andersson <>,,,
        Akhil P Oommen <>,
        Jorge Ramirez-Ortiz <>,
        Douglas Anderson <>,
        Srinivas Kandagatla <>,
Subject: [PATCH 3/3] nvmem: core: nvmem_cell_read() should return the true size

If we look at the gpu speed bin currently in sc7180.dtsi:
  gpu_speed_bin: gpu_speed_bin@1d2 {
    reg = <0x1d2 0x2>;
    bits = <5 8>;

We can see that this is an 8-bit value.  However we had to specify the
"reg" as 16 bits because the value was spread out over two bytes.

It doesn't make sense to expose the fact that the value was spread out
over two bytes to the client.  Let's use the number of bits to return
the length to the client.

NOTE: this change has the potential to break clients!  Hopefully this
breakage will be lessened (or eliminated) with the previous patch
("nvmem: core: Allow nvmem_cell_read_u16/32/64 to read smaller
cells"), but it is possible for anyone directly calling
nvmem_cell_read().  From a quick audit of mainline I don't _see_ any
problems.  Most cases won't change at all (number of bits matched the
length) and the big case that will change is the Qualcomm "CPR" driver
which seems to handle the length properly (it could probably be
simplified now, actually).

Signed-off-by: Douglas Anderson <>

 drivers/nvmem/core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 8602390bb124..00454d841a7f 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1379,6 +1379,7 @@ static int __nvmem_cell_read(struct nvmem_device *nvmem,
 		      void *buf, size_t *len)
 	int rc;
+	size_t bytes;
 	rc = nvmem_reg_read(nvmem, cell->offset, buf, cell->bytes);
@@ -1386,11 +1387,15 @@ static int __nvmem_cell_read(struct nvmem_device *nvmem,
 		return rc;
 	/* shift bits in-place */
-	if (cell->bit_offset || cell->nbits)
+	if (cell->bit_offset || cell->nbits) {
 		nvmem_shift_read_buffer_in_place(cell, buf);
+		bytes = DIV_ROUND_UP(cell->nbits, 8);
+	} else {
+		bytes = cell->bytes;
+	}
 	if (len)
-		*len = cell->bytes;
+		*len = bytes;
 	return 0;

Powered by blists - more mailing lists