From: sashiko-bot@kernel.org
To: "Stephen Bancroft" <stevereaver@gmail.com>,
linux-mtd@lists.infradead.org
Cc: "Vignesh Raghavendra" <vigneshr@ti.com>,
"Miquel Raynal" <miquel.raynal@bootlin.com>,
"Richard Weinberger" <richard@nod.at>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3] mtd: maps: add INT0800 firmware-flash map driver
Date: Mon, 21 Sep 2026 02:30:11 +0000 [thread overview]
Message-ID: <20260921023012.556771F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260921021459.283023-1-stevereaver@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mtd: maps: Use-After-Free in int0800 via sysfs driver unbind
--
commit 2d904c4a0ae5009245dd1587c804f0ac6e9402b8
Author: Stephen Bancroft <stevereaver@gmail.com>
mtd: maps: add INT0800 firmware-flash map driver
Adds a read-only MTD mapping driver that binds the ACPI INT0800 device and
exposes the system firmware flash as an MTD ROM device.
> diff --git a/drivers/mtd/maps/int0800.c b/drivers/mtd/maps/int0800.c
> new file mode 100644
> index 0000000000000..0188d58b168d9
> --- /dev/null
> +++ b/drivers/mtd/maps/int0800.c
[ ... ]
> +static void int0800_remove(struct platform_device *pdev)
> +{
> + struct int0800 *fw = platform_get_drvdata(pdev);
> +
> + mtd_device_unregister(fw->mtd);
> + map_destroy(fw->mtd);
> +}
[Severity: High]
Can this lead to a use-after-free and unmapped memory dereference if a
user forces a driver unbind via sysfs while the character device is still
open?
If a privileged user opens /dev/mtdX and then writes to
/sys/bus/platform/drivers/int0800/unbind, int0800_remove() is invoked.
This unconditionally calls map_destroy(fw->mtd), freeing the mtd_info
structure and allowing devres to unmap fw->map.virt.
Since mtdchar_open() incrementing the module use-count does not prevent
forced sysfs unbinds, a subsequent read() on the still-open file
descriptor would dereference the freed mtd_info and read from the
unmapped memory.
Should this driver set .suppress_bind_attrs = true in the platform_driver
to prevent forced sysfs unbinds?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260921021459.283023-1-stevereaver@gmail.com?part=1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
next prev parent reply other threads:[~2026-09-21 2:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <V2-MESSAGE-ID>
2026-09-21 2:14 ` [PATCH v3] mtd: maps: add INT0800 firmware-flash map driver Stephen Bancroft
2026-09-21 2:30 ` sashiko-bot [this message]
2026-09-23 9:26 ` [PATCH v4] " Stephen Bancroft
2026-09-23 9:41 ` sashiko-bot
2026-09-23 11:57 ` Steve Reaver
2026-09-25 14:29 ` Miquel Raynal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921023012.556771F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=miquel.raynal@bootlin.com \
--cc=richard@nod.at \
--cc=sashiko-reviews@lists.linux.dev \
--cc=stevereaver@gmail.com \
--cc=vigneshr@ti.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.