From nobody Sat Feb 7 06:21:02 2026 Received: from tree.mlotz.ch (tree.mlotz.ch [95.217.131.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C00E82772D for ; Wed, 4 Feb 2026 23:15:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.217.131.6 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770246943; cv=none; b=nnAq+0rOQBOsHJP7i7BfdHvgGbimHquwYcISXhMqV8k1CEVOt0avrsKuEw52fJ4isImNO34Vn9EM522IVwDD9HdXN4qUoFodi/lav65wzO/BPZ6t5snP0Be4ziSRQwztvMt9LdQZoUTS0gxIqLgHq17KknvFZGcsGiPfOfom55I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770246943; c=relaxed/simple; bh=7wnmJsvC5/MSDEf3pQqbaDiETTrEXl7y35aHk+fGbIs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nYpxm5RAcXNVxiPgVT8Wj+dAg70vh65QKI7draSSc91IkBIZcJK974kPv1eK8HW91DjDBM558PKElMBwSajBUNq1fBSw/JVsSiU+mn4W3ihIffq4FlcMHRfaV2ioQabBOTYGWbyTU/pVffGAZuLjyBZcvixVcj1HANKbOsvoi4Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mlotz.ch; spf=pass smtp.mailfrom=mlotz.ch; arc=none smtp.client-ip=95.217.131.6 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mlotz.ch Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mlotz.ch Received: by tree.mlotz.ch (Postfix) id 05ED243FF8; Wed, 04 Feb 2026 23:07:00 +0000 (UTC) From: Michael Lotz To: linux-kernel@vger.kernel.org Cc: Srinivas Kandagatla , Michael Lotz Subject: [PATCH] nvmem: fix cell write clobber of outside bits Date: Thu, 5 Feb 2026 00:06:49 +0100 Message-ID: <20260204230649.528235-1-mmlr@mlotz.ch> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a nvmem cell uses bits and does not end on a byte boundary, the missing upper bits are filled by reading the pre-existing value. These are masked and or-ed with the value in the write buffer, which comes from the user provided input buffer. However, when the input buffer has bits set outside the bit width of the cell, those were never cleared. That allowed a nvmem cell write to clobber the remaining upper bits of the last byte. Example cell declaration: status@0 { reg =3D <0x0 0x1>; bits =3D <2 2>; }; Existing value: 0x10 Write value: 0xff Expected result: 0x1c Actual result: 0xfc Fix this by first clearing the bits of the write buffer that are outside of the cell and only then or-ing the pre-existing value. Signed-off-by: Michael Lotz --- drivers/nvmem/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index 387c88c55259..25184f75b9ea 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1709,7 +1709,7 @@ static void *nvmem_cell_prepare_write_buffer(struct n= vmem_cell_entry *cell, { struct nvmem_device *nvmem =3D cell->nvmem; int i, rc, nbits, bit_offset =3D cell->bit_offset; - u8 v, *p, *buf, *b, pbyte, pbits; + u8 v, *p, *buf, *b, pbyte, pbits, mask; =20 nbits =3D cell->nbits; buf =3D kzalloc(cell->bytes, GFP_KERNEL); @@ -1747,8 +1747,10 @@ static void *nvmem_cell_prepare_write_buffer(struct = nvmem_cell_entry *cell, cell->offset + cell->bytes - 1, &v, 1); if (rc) goto err; - *p |=3D GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v; =20 + mask =3D GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE); + *p &=3D ~mask; + *p |=3D v & mask; } =20 return buf; --=20 2.43.0