Hi Steffen,

On Mon, Jun 23 2025, Steffen Bätz wrote:

The commit "13bcd440f2ff nvmem: core: verify cell's raw_len" caused an extension of the "mac-address" cell from 6 to 8 bytes due to word_size of 4 bytes.

Thus, the required byte swap for the mac-address of the full buffer length, caused an trucation of the read mac-address. From the original address 70:B3:D5:14:E9:0E to 00:00:70:B3:D5:14

After swapping only the first 6 bytes, the mac-address is correctly passed to the upper layers.

Fixes: 13bcd440f2ff ("nvmem: core: verify cell's raw_len") Cc: stable@vger.kernel.org Signed-off-by: Steffen Bätz steffen@innosonix.de

---

v2:

• Add Cc: stable@vger.kernel.org as requested by Greg KH's patch bot

drivers/nvmem/imx-ocotp-ele.c | 2 ++ drivers/nvmem/imx-ocotp.c | 2 ++ 2 files changed, 4 insertions(+)

diff --git a/drivers/nvmem/imx-ocotp-ele.c b/drivers/nvmem/imx-ocotp-ele.c index ca6dd71d8a2e..3af7968f5a34 100644 --- a/drivers/nvmem/imx-ocotp-ele.c +++ b/drivers/nvmem/imx-ocotp-ele.c @@ -119,6 +119,8 @@ static int imx_ocotp_cell_pp(void *context, const char *id, int index, /* Deal with some post processing of nvmem cell data */ if (id && !strcmp(id, "mac-address"))

• if (bytes > 6)
  

• 	bytes = 6;
  

Maybe better use ETH_ALEN instead of magic number?

baruch

for (i = 0; i < bytes / 2; i++)
	swap(buf[i], buf[bytes - i - 1]);

diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c index 79dd4fda0329..63e9974d9618 100644 --- a/drivers/nvmem/imx-ocotp.c +++ b/drivers/nvmem/imx-ocotp.c @@ -228,6 +228,8 @@ static int imx_ocotp_cell_pp(void *context, const char *id, int index, /* Deal with some post processing of nvmem cell data */ if (id && !strcmp(id, "mac-address"))

• if (bytes > 6)
  

• 	bytes = 6;
  

  for (i = 0; i < bytes / 2; i++) swap(buf[i], buf[bytes - i - 1]);