Re: [PATCH v8 5/8] nvmem: layouts: add Microchip/SST SFDP EUI layout driver - sashiko-bot

From: sashiko-bot@kernel.org
To: "Manikandan Muralidharan" <manikandan.m@microchip.com>,
	pratyush@kernel.org, mwalle@kernel.org,
	takahiro.kuwano@infineon.com, miquel.raynal@bootlin.com,
	richard@nod.at, vigneshr@ti.com, robh@kernel.org,
	krzk+dt@kernel.org, conor+dt@kernel.org, srini@kernel.org,
	nicolas.ferre@microchip.com, alexandre.belloni@bootlin.com,
	claudiu.beznea@tuxon.dev, linux@armlinux.org.uk,
	richardcochran@gmail.com, linusw@kernel.org, arnd@arndb.de,
	aaro.koskinen@iki.fi, gregkh@linuxfoundation.org,
	mathieu.dubois-briand@bootlin.com, michael@walle.cc,
	linux-mtd@lists.infradead.org, devicetree@vger.kernel.org
Subject: Re: [PATCH v8 5/8] nvmem: layouts: add Microchip/SST SFDP EUI layout driver
Date: Thu, 15 Oct 2026 06:42:05 +0000	[thread overview]
Message-ID: <sashiko-outbox-172353@kernel.org> (raw)
In-Reply-To: <89aa4ac1eee01e3c425c12367f1e036354787ce8.1790847519.git.manikandan.m@microchip.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] nvmem: use-after-free on layout driver module unload
--

commit 4e7e82e84f19ca0cc7f7eae9477c171b2bdab685
Author: Manikandan Muralidharan <manikandan.m@microchip.com>

nvmem: layouts: add Microchip/SST SFDP EUI layout driver

This commit adds an NVMEM layout that exposes the factory-programmed
EUI-48 identifier from the Microchip/SST vendor SFDP parameter table
as a "mac-address" cell.

> diff --git a/drivers/nvmem/layouts/sst26vf-sfdp-eui.c b/drivers/nvmem/layouts/sst26vf-sfdp-eui.c
> new file mode 100644
> index 0000000000000..641318d6f0af6
> --- /dev/null
> +++ b/drivers/nvmem/layouts/sst26vf-sfdp-eui.c

[ ... ]

> +	info.name = "mac-address";
> +	info.offset = base + SFDP_MCHP_EUI48_OFFSET;
> +	info.bytes = ETH_ALEN;
> +	info.np = of_get_child_by_name(layout_np, "mac-address");
> +	info.read_post_process = sfdp_eui_read_post_process;
> +
> +	ret = nvmem_add_one_cell(nvmem, &info);

[ ... ]

> +static void sfdp_eui_remove(struct nvmem_layout *layout)
> +{
> +	nvmem_layout_unregister(layout);
> +}

[Severity: High]
Does this leave a dangling pointer if the layout module is unloaded?

In sfdp_eui_add_cells(), the driver registers sfdp_eui_read_post_process() as
a callback via nvmem_add_one_cell(). However, the NVMEM core tracks the
provider device's module, not the layout driver module. 

Furthermore, nvmem_layout_unregister() is an empty stub in the NVMEM core.
Because the core API does not remove the cells, the cell remains in the
NVMEM device's cell list with a dangling read_post_process function pointer.

If the layout module is unloaded and the cell is subsequently read (e.g.,
via sysfs), could this execute unmapped module memory and cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1790847519.git.manikandan.m@microchip.com?part=5

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/