linux-stable/drivers/nvmem
Stephen Boyd 5d388fa01f nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic

 *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);

will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we
subtract one from that making a large number that is then shifted more than the
number of bits that fit into an unsigned long.

UBSAN reports this problem:

 UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8
 shift exponent 64 is too large for 64-bit type 'unsigned long'
 CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9
 Hardware name: Google Lazor (rev3+) with KB Backlight (DT)
 Workqueue: events_unbound deferred_probe_work_func
 Call trace:
  dump_backtrace+0x0/0x170
  show_stack+0x24/0x30
  dump_stack_lvl+0x64/0x7c
  dump_stack+0x18/0x38
  ubsan_epilogue+0x10/0x54
  __ubsan_handle_shift_out_of_bounds+0x180/0x194
  __nvmem_cell_read+0x1ec/0x21c
  nvmem_cell_read+0x58/0x94
  nvmem_cell_read_variable_common+0x4c/0xb0
  nvmem_cell_read_variable_le_u32+0x40/0x100
  a6xx_gpu_init+0x170/0x2f4
  adreno_bind+0x174/0x284
  component_bind_all+0xf0/0x264
  msm_drm_bind+0x1d8/0x7a0
  try_to_bring_up_master+0x164/0x1ac
  __component_add+0xbc/0x13c
  component_add+0x20/0x2c
  dp_display_probe+0x340/0x384
  platform_probe+0xc0/0x100
  really_probe+0x110/0x304
  __driver_probe_device+0xb8/0x120
  driver_probe_device+0x4c/0xfc
  __device_attach_driver+0xb0/0x128
  bus_for_each_drv+0x90/0xdc
  __device_attach+0xc8/0x174
  device_initial_probe+0x20/0x2c
  bus_probe_device+0x40/0xa4
  deferred_probe_work_func+0x7c/0xb8
  process_one_work+0x128/0x21c
  process_scheduled_works+0x40/0x54
  worker_thread+0x1ec/0x2a8
  kthread+0x138/0x158
  ret_from_fork+0x10/0x20

Fix it by making sure there are any bits to mask out.

Fixes: 69aba7948c ("nvmem: Add a simple NVMEM framework for consumers")
Cc: Douglas Anderson <dianders@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20211013124511.18726-1-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-13 15:09:58 +02:00
..
bcm-ocotp.c nvmem: bcm-ocotp: Add ACPI support to BCM OCOTP 2019-01-31 16:24:14 +01:00
brcm_nvram.c nvmem: brcm_nvram: new driver exposing Broadcom's NVRAM 2021-04-02 16:26:33 +02:00
core.c nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells 2021-10-13 15:09:58 +02:00
imx-iim.c nvmem: imx-iim: Use of_device_get_match_data() 2021-02-04 17:04:18 +01:00
imx-ocotp-scu.c nvmem: imx: scu: correct the fuse word index 2020-01-10 13:52:12 +01:00
imx-ocotp.c nvmem: imx-ocotp: add support for the unaliged word count 2020-11-27 16:10:07 +01:00
jz4780-efuse.c nvmem: jz4780-efuse: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:20:02 +02:00
Kconfig nvmem: NVMEM_NINTENDO_OTP should depend on WII 2021-09-21 17:38:37 +02:00
lpc18xx_eeprom.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lpc18xx_otp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Makefile nvmem: nintendo-otp: Add new driver for the Wii and Wii U OTP 2021-08-13 10:27:20 +02:00
meson-efuse.c firmware: meson_sm: Rework driver as a proper platform driver 2019-10-03 08:43:33 -07:00
meson-mx-efuse.c nvmem: meson-mx-efuse: allow reading data smaller than word_size 2019-08-18 12:56:52 +02:00
mtk-efuse.c nvmem: mtk-efuse: Remove EFUSE register write support 2020-09-17 18:48:23 +02:00
mxs-ocotp.c nvmem: mxs-ocotp: Use devm_add_action_or_reset() for cleanup 2020-03-23 20:05:23 +01:00
nintendo-otp.c nvmem: nintendo-otp: Add new driver for the Wii and Wii U OTP 2021-08-13 10:27:20 +02:00
qcom-spmi-sdam.c nvmem: convert comma to semicolon 2021-04-02 16:26:33 +02:00
qfprom.c nvmem: qfprom: sc7280: Handle the additional power-domains vote 2021-08-06 15:18:40 +02:00
rave-sp-eeprom.c nvmem: rave-sp-eeprom: Remove VLA usage 2018-07-07 17:30:46 +02:00
rmem.c nvmem: Add driver to expose reserved memory as nvmem 2021-02-04 17:04:18 +01:00
rockchip-efuse.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295 2019-06-05 17:36:38 +02:00
rockchip-otp.c nvmem: add Rockchip OTP driver 2019-11-05 18:35:33 +01:00
sc27xx-efuse.c nvmem: sc27xx: add sc2730 efuse support 2020-07-29 17:12:08 +02:00
snvs_lpgpr.c nvmem: convert comma to semicolon 2021-04-02 16:26:33 +02:00
sprd-efuse.c nvmem: sprd: Fix an error message 2021-05-14 13:39:50 +02:00
stm32-romem.c nvmem: stm32: add support for STM32MP15 BSEC to control OTP data 2019-04-25 19:43:12 +02:00
sunxi_sid.c nvmem: sunxi_sid: Set type to OTP 2021-06-11 10:57:52 +02:00
uniphier-efuse.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
vf610-ocotp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
zynqmp_nvmem.c firmware: xilinx: Remove eemi ops for get_chipid 2020-04-28 15:45:06 +02:00