Re: [PATCHv2] ARM: dts: BCM5301X: AC56U: add nvram node

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Zero-size allocation leads to a kernel panic if NVRAM is completely empty or uninitialized.
--

commit 3e511df55083f5f3829311b665dd624ff8599e95
Author: Rosen Penev <rosenp@gmail.com>

ARM: dts: BCM5301X: AC56U: add nvram node

This commit adds the brcm,nvram node to the bcm4708-asus-rt-ac56u device tree.
It configures it for gmac0, which is the only GMAC used on this board, and sets
the size based on a bootlog.

> diff --git a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> index c80ac16ad9496..9ab618a097b1f 100644
> --- a/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> +++ b/arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dts
> @@ -25,6 +25,15 @@ memory@0 {
>  		      <0x88000000 0x08000000>;
>  	};
>  
> +	nvram@1c080000 {
> +		compatible = "brcm,nvram";
> +		reg = <0x1c080000 0x180000>;
> +
> +		et0macaddr: et0macaddr {
> +			#nvmem-cell-cells = <1>;
> +		};
> +	};
> +

[Severity: High]
This isn't a bug introduced by this patch, but enabling the brcm,nvram node
exposes a potential kernel panic in the nvmem driver if the NVRAM is
completely empty or uninitialized.

In drivers/nvmem/brcm_nvram.c:brcm_nvram_copy_data(), if the flash partition
consists only of padding bytes (e.g., after an erase), the scanning loop
decrements priv->data_len to 0:

	for (priv->data_len = priv->nvmem_size;
	     priv->data_len;
	     priv->data_len--) {
		if (readb(base + priv->data_len - 1) != priv->padding_byte)
			break;
	}

This results in a zero-byte allocation:

	priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL);

If priv->data_len is 0, devm_kzalloc() returns ZERO_SIZE_PTR (0x10) rather
than NULL, so execution continues successfully to brcm_nvram_parse().

The driver then attempts to read the header:

	struct brcm_nvram_header *header = (struct brcm_nvram_header *)priv->data;
	...
	if (memcmp(header->magic, NVRAM_MAGIC, 4)) {

This dereferences ZERO_SIZE_PTR (0x10), which causes a page fault and kernel
panic on devices with erased NVRAM.

Could a check be added for priv->data_len == 0 in the nvmem driver to prevent
this unrecoverable boot failure before enabling the node in the device tree?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910001209.116465-1-rosenp@gmail.com?part=1