linux-kernel - [PATCH] nvmem: fix cell write clobber of outside bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260204230649.528235-1-mmlr@mlotz.ch>
Date: Thu,  5 Feb 2026 00:06:49 +0100
From: Michael Lotz <mmlr@...tz.ch>
To: linux-kernel@...r.kernel.org
Cc: Srinivas Kandagatla <srini@...nel.org>,
	Michael Lotz <mmlr@...tz.ch>
Subject: [PATCH] nvmem: fix cell write clobber of outside bits

When a nvmem cell uses bits and does not end on a byte boundary, the
missing upper bits are filled by reading the pre-existing value. These
are masked and or-ed with the value in the write buffer, which comes
from the user provided input buffer. However, when the input buffer has
bits set outside the bit width of the cell, those were never cleared.
That allowed a nvmem cell write to clobber the remaining upper bits of
the last byte.

Example cell declaration:

    status@0 {
        reg = <0x0 0x1>;
        bits = <2 2>;
    };

Existing value:  0x10
Write value:     0xff
Expected result: 0x1c
Actual result:   0xfc

Fix this by first clearing the bits of the write buffer that are
outside of the cell and only then or-ing the pre-existing value.

Signed-off-by: Michael Lotz <mmlr@...tz.ch>
---
 drivers/nvmem/core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 387c88c55259..25184f75b9ea 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1709,7 +1709,7 @@ static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell,
 {
 	struct nvmem_device *nvmem = cell->nvmem;
 	int i, rc, nbits, bit_offset = cell->bit_offset;
-	u8 v, *p, *buf, *b, pbyte, pbits;
+	u8 v, *p, *buf, *b, pbyte, pbits, mask;
 
 	nbits = cell->nbits;
 	buf = kzalloc(cell->bytes, GFP_KERNEL);
@@ -1747,8 +1747,10 @@ static void *nvmem_cell_prepare_write_buffer(struct nvmem_cell_entry *cell,
 				    cell->offset + cell->bytes - 1, &v, 1);
 		if (rc)
 			goto err;
-		*p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v;
 
+		mask = GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE);
+		*p &= ~mask;
+		*p |= v & mask;
 	}
 
 	return buf;
-- 
2.43.0