Re: [PATCH v2 3/4] nvmem: layouts: Add Rockchip OTP CPUID layout driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Module unload leaves dangling function pointer in nvmem core, leading to UAF.
--

commit 98e250115f0c3368e5e5888d572a646b22e0ad3d
Author: Alexey Charkov <alchark@flipper.net>

nvmem: layouts: Add Rockchip OTP CPUID layout driver

This patch adds an nvmem layout driver for the CPU ID in Rockchip OTP
memory. It exposes the CPU ID as an nvmem cell named "mac-address" to
reproduce the derivation done by bootloaders.

> diff --git a/drivers/nvmem/layouts/rockchip-otp-cpuid.c b/drivers/nvmem/layouts/rockchip-otp-cpuid.c
> new file mode 100644
> index 0000000000000..61f509c4a8cf2
> --- /dev/null
> +++ b/drivers/nvmem/layouts/rockchip-otp-cpuid.c
> @@ -0,0 +1,119 @@

[ ... ]

> +static int rockchip_cpuid_add_cells(struct nvmem_layout *layout)
> +{

[ ... ]

> +	info.name = "mac-address";
> +	info.offset = data->offset;
> +	info.raw_len = ROCKCHIP_CPUID_LEN;
> +	info.bytes = ETH_ALEN;
> +	info.read_post_process = rockchip_cpuid_mac_pp;
> +	info.np = of_get_child_by_name(layout_np, info.name);
> +
> +	of_node_put(layout_np);
> +
> +	ret = nvmem_add_one_cell(layout->nvmem, &info);
> +	if (ret)
> +		of_node_put(info.np);
> +
> +	return ret;
> +}

[ ... ]

> +static void rockchip_cpuid_remove(struct nvmem_layout *layout)
> +{
> +	nvmem_layout_unregister(layout);
> +}

[Severity: High]
This isn't a bug introduced by this patch, but is a pre-existing design flaw
in the nvmem core that this new layout driver inherits.

When this layout driver is unloaded, does it leave a dangling function
pointer behind?

The remove function calls nvmem_layout_unregister(), but since that is an
empty stub in the nvmem core, the registered nvmem cell and its sysfs
attributes remain intact.

If the cell is later read via sysfs (e.g., through
/sys/bus/nvmem/devices/.../cells/mac-address) after the module is unloaded,
will it invoke the dangling read_post_process function pointer
(rockchip_cpuid_mac_pp) without taking a module reference, leading to a
use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902-rk3576-otp-cpuid-mac-v2-0-e4b7fe2ab13f@flipper.net?part=3