[PATCH v3] staging: nvec: validate battery response length before memcpy

Sebastian Josue Alba Vives
2026-03-30T12:52:17Z

From: Sebastián Alba Vives <sebasjosue84@gmail.com>

In nvec_power_notifier(), the response length from the embedded
controller is used directly as the size argument to memcpy() when
copying battery manufacturer, model, and type strings. The
destination buffers (bat_manu, bat_model, bat_type) are fixed at
30 bytes, but res->length is a u8 that can be up to 255, allowing
a heap buffer overflow.

Additionally, if res->length is less than 2, the subtraction
res->length - 2 wraps around as an unsigned value, resulting in a
large copy that corrupts kernel heap memory.

Introduce NVEC_BAT_STRING_SIZE to replace the hardcoded buffer
size, store res->length - 2 in a local copy_len variable for
clarity, and add bounds checks before each memcpy to ensure the
copy length does not exceed the destination buffer and that
res->length is at least 2 to prevent unsigned integer underflow.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202603301722.axpoITcy-lkp@intel.com/
Tested-by: Marc Dietrich <marvin24@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Sebastián Alba Vives <sebasjosue84@gmail.com>
---
v3:
- Fix build error: add missing closing brace for TYPE case
compound statement (kernel test robot)
v2:
- Introduce NVEC_BAT_STRING_SIZE constant (Marc Dietrich)
- Store res->length - 2 in local copy_len variable (Marc Dietrich)
- Use NVEC_BAT_STRING_SIZE in strncmp call for consistency
drivers/staging/nvec/nvec_power.c | 42 +++++++++++++++++++++----------
1 file changed, 29 insertions(+), 13 deletions(-)

diff --git a/drivers/staging/nvec/nvec_power.c b/drivers/staging/nvec/nvec_power.c
index 2faab9fde..30719e142 100644
--- a/drivers/staging/nvec/nvec_power.c
+++ b/drivers/staging/nvec/nvec_power.c
@@ -19,6 +19,7 @@
#include "nvec.h"

#define GET_SYSTEM_STATUS 0x00
+#define NVEC_BAT_STRING_SIZE 30

struct nvec_power {
struct notifier_block notifier;
@@ -38,9 +39,9 @@ struct nvec_power {
int bat_temperature;
int bat_cap;
int bat_type_enum;
- char bat_manu[30];
- char bat_model[30];
- char bat_type[30];
+ char bat_manu[NVEC_BAT_STRING_SIZE];
+ char bat_model[NVEC_BAT_STRING_SIZE];
+ char bat_type[NVEC_BAT_STRING_SIZE];
};

enum {
@@ -192,26 +193,41 @@ static int nvec_power_bat_notifier(struct notifier_block *nb,
case TEMPERATURE:
power->bat_temperature = res->plu - 2732;
break;
- case MANUFACTURER:
- memcpy(power->bat_manu, &res->plc, res->length - 2);
- power->bat_manu[res->length - 2] = '\0';
+ case MANUFACTURER: {
+ size_t copy_len = res->length - 2;
+
+ if (res->length < 2 || copy_len > NVEC_BAT_STRING_SIZE - 1)
+ break;
+ memcpy(power->bat_manu, &res->plc, copy_len);
+ power->bat_manu[copy_len] = '\0';
break;
- case MODEL:
- memcpy(power->bat_model, &res->plc, res->length - 2);
- power->bat_model[res->length - 2] = '\0';
+ }
+ case MODEL: {
+ size_t copy_len = res->length - 2;
+
+ if (res->length < 2 || copy_len > NVEC_BAT_STRING_SIZE - 1)
+ break;
+ memcpy(power->bat_model, &res->plc, copy_len);
+ power->bat_model[copy_len] = '\0';
break;
- case TYPE:
- memcpy(power->bat_type, &res->plc, res->length - 2);
- power->bat_type[res->length - 2] = '\0';
+ }
+ case TYPE: {
+ size_t copy_len = res->length - 2;
+
+ if (res->length < 2 || copy_len > NVEC_BAT_STRING_SIZE - 1)
+ break;
+ memcpy(power->bat_type, &res->plc, copy_len);
+ power->bat_type[copy_len] = '\0';
/*
* This differs a little from the spec fill in more if you find
* some.
*/
- if (!strncmp(power->bat_type, "Li", 30))
+ if (!strncmp(power->bat_type, "Li", NVEC_BAT_STRING_SIZE))
power->bat_type_enum = POWER_SUPPLY_TECHNOLOGY_LION;
else
power->bat_type_enum = POWER_SUPPLY_TECHNOLOGY_UNKNOWN;
break;
+ }
default:
return NOTIFY_STOP;
}
--
2.43.0