Re: [PATCH RESEND v3 3/4] firmware: raspberrypi: Add reboot mode support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-after-free race condition if devm_add_action_or_reset() fails after drvdata is set.
--

commit ea24b0bc9b26402781f7da38607787a0f6b47e39
Author: Gregor Herburger <gregor.herburger@linutronix.de>

firmware: raspberrypi: Add reboot mode support
    
The Raspberry Pi firmware has a tryboot mode where it tries to boot from
another partition. This can be used to create a A/B update scheme.

To enable this on the next boot, the RPI_FIRMWARE_SET_REBOOT_FLAGS
message must be sent to the firmware. Add support for this by
registering a reboot mode driver.

> diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
> index 0aa322e9a2e73..2a0c40b8052e5 100644
> --- a/drivers/firmware/raspberrypi.c
> +++ b/drivers/firmware/raspberrypi.c
[ ... ]
> @@ -302,9 +331,14 @@ static int rpi_firmware_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, fw);
>  
> +	ret = devm_add_action_or_reset(dev, devm_rpi_firmware_put, fw);
> +	if (ret)
> +		return ret;

[Severity: High]
If devm_add_action_or_reset() fails here, could this create a use-after-free 
race condition?

When the failure occurs, devm_add_action_or_reset() immediately executes
devm_rpi_firmware_put(), which drops the refcount and frees the fw context. 
Because platform_set_drvdata() was already called, the driver data 
will point to this freed memory until the core probe cleanup mechanism 
eventually clears it.

During this window, a consumer driver could call rpi_firmware_get(), which
performs a lockless lookup of drvdata and attempts to dereference the freed
pointer:

drivers/firmware/raspberrypi.c:rpi_firmware_get() {
    ...
	fw = platform_get_drvdata(pdev);
	if (!fw)
		goto err_put_device;

	if (!kref_get_unless_zero(&fw->consumers))
		goto err_put_device;
    ...
}

> +
>  	rpi_firmware_print_firmware_revision(fw);
>  	rpi_register_hwmon_driver(dev, fw);
>  	rpi_register_clk_driver(dev);
> +	rpi_register_reboot_mode(dev, fw);
>  
>  	return 0;
>  }
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903-rpi-tryboot-v3-0-ce94c347e932@linutronix.de?part=3