Re: [PATCH v8 05/12] nvmem: Add the Raspberry Pi OTP driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] nvmem: raspberrypi-otp: fortify panic in rpi_otp_read() on
  short count
--

commit c10d09bc13f73c4dd03231f9da5b8e776da5b958
Author: Gregor Herburger <gregor.herburger@linutronix.de>

nvmem: Add the Raspberry Pi OTP driver

This commit adds an nvmem driver to access the Raspberry Pi customer and
private OTP registers through the VideoCore firmware interface.

> diff --git a/drivers/nvmem/raspberrypi-otp.c b/drivers/nvmem/raspberrypi-otp.c
> new file mode 100644
> index 0000000000000..2e2537ee6793b
> --- /dev/null
> +++ b/drivers/nvmem/raspberrypi-otp.c
> @@ -0,0 +1,131 @@

[ ... ]

> +struct rpi_otp_header {
> +	__le32 start;
> +	__le32 count;
> +	__le32 data[] __counted_by_le(count);
> +};
> +
> +static int rpi_otp_read(void *context, unsigned int offset, void *buf, size_t bytes)
> +{
> +	struct rpi_otp_priv *priv = context;
> +	struct rpi_otp_header *fwbuf;
> +	u32 count;
> +	int ret;
> +
> +	count = bytes / 4;
> +
> +	fwbuf = kzalloc(struct_size(fwbuf, data, count), GFP_KERNEL);
> +	if (!fwbuf)
> +		return -ENOMEM;
> +
> +	fwbuf->start = cpu_to_le32(offset / 4);
> +	fwbuf->count = cpu_to_le32(count);
> +
> +	ret = rpi_firmware_property(priv->fw, priv->read_tag, fwbuf,
> +				    sizeof(struct rpi_otp_header) + bytes);
> +	if (ret)
> +		goto out;
> +
> +	memcpy(buf, fwbuf->data, bytes);

[Severity: High]
Can this memcpy() trigger a fortify panic if the firmware response modifies
fwbuf->count?

rpi_firmware_property() overwrites the entire fwbuf buffer, including
fwbuf->count, with the response from the firmware.  Because fwbuf->data[]
is annotated with __counted_by_le(count), CONFIG_FORTIFY_SOURCE evaluates
the runtime size of fwbuf->data from the returned fwbuf->count value, so
if the firmware zeroes or reduces fwbuf->count on a partial or unsupported
read, memcpy(buf, fwbuf->data, bytes) will call fortify_panic().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110-rpi-otp-driver-v8-0-797e0577d414@linutronix.de?part=5