Re: [PATCH 16/26] sh: maple: remove unused driver field from struct maple_device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] vmu_can_unload() crashes on hot-unplug if the driver fails to probe or is unbound.
--

commit 03c570da1dc6a7b4d15fe87da8cdddba6169830d
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>

sh: maple: remove unused driver field from struct maple_device

The commit removes the unused driver field from struct maple_device since all 
readers and writers of this field have been eliminated from the maple bus code.

> diff --git a/include/linux/maple.h b/include/linux/maple.h
> index 22f2930251edc..90c26c86e3ede 100644
> --- a/include/linux/maple.h
> +++ b/include/linux/maple.h
> @@ -64,7 +64,6 @@ struct maple_devinfo {
>  };
>  
>  struct maple_device {
> -	struct maple_driver *driver;
>  	struct mapleq *mq;
>  	void (*callback) (struct mapleq * mq);
>  	void (*fileerr_handler)(struct maple_device *mdev, void *recvbuf);

[Severity: High]
This is a pre-existing issue, but while reviewing changes to struct
maple_device, I noticed a potential null pointer dereference in the vmu-flash
driver.

In drivers/mtd/maps/vmu-flash.c:probe_maple_vmu(), the can_unload callback is
set:

probe_maple_vmu() {
        ...
        mdev->can_unload = vmu_can_unload;
        ...
}

If probe fails during device connection or if the driver is unbound via sysfs,
the driver core clears the device's driver data to NULL. However,
mdev->can_unload remains pointing to vmu_can_unload.

If the device is subsequently hot-unplugged, the maple bus core calls
maple_response_none() -> mdev->can_unload(mdev), which dereferences the
driver data without checking if it is NULL:

vmu_can_unload() {
        ...
        card = maple_get_drvdata(mdev);
        for (x = 0; x < card->partitions; x++) {
        ...
}

Could this cause a system crash on hot-unplug? Should mdev->can_unload be
cleared on the probe error path and during unbind?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703-b4-maple-cleanup-v1-0-41e424964da5@gmail.com?part=16