Re: [PATCH v2 1/2] power: sequencing: pcie-m2: fix use-after-free in pwrseq_pcie_m2_vregs_enable()

[sashiko-bot@kernel.org]

> During device teardown or on the probe error path, a concurrent consumer
> access triggers a use-after-free in pwrseq_pcie_m2_vregs_enable() or
> pwrseq_pcie_m2_vregs_disable() due to a lifetime inversion between
> devm-managed device registration and manual resource cleanup.
> 
> The driver exposes the power sequencer using devm_pwrseq_device_register(),
> meaning the device remains fully registered and accessible on the
> pwrseq_bus until the driver core schedules devm_pwrseq_device_unregister()
> to run after pwrseq_pcie_m2_remove() returns. However, the driver performs
> manual resource teardown within pwrseq_pcie_m2_remove() and the
> pwrseq_pcie_m2_probe() error path, prematurely destroying the backing
> regulator array.
> 
> This creates a narrow vulnerability window where the globally visible power
> sequencer is backed by freed memory. If a concurrent consumer invokes
> pwrseq_enable() during this window, execution is routed to the sequencer
> callback and dereferences the destroyed ctx->regs array, resulting in a
> direct use-after-free and a kernel crash.
> 
> Schedule a devres action for freeing the memory used for the regulator
> array to ensure it runs *after* the pwrseq provider was unregistered.
> 
> Cc: stable@vger.kernel.org
> Fixes: 3f736aecbdc8 ("power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth")
> Closes: https://sashiko.dev/#/bug/linux-bd17e5b1-a000-4717-b392-0ff0c2a9c376
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-pwrseq-pcie-m2-uaf-v2-0-3e1dd415af9a@oss.qualcomm.com?part=1