Re: [PATCH 51/58] mtd: rawnand: mpc5121: retain chip state across removal - sashiko-bot

From: sashiko-bot@kernel.org
To: "James Hilliard" <james.hilliard1@gmail.com>,
	"Miquel Raynal" <miquel.raynal@bootlin.com>,
	"Richard Weinberger" <richard@nod.at>,
	"Vignesh Raghavendra" <vigneshr@ti.com>,
	"Brian Norris" <computersforpeace@gmail.com>,
	"Boris Brezillon" <bbrezillon@kernel.org>,
	"Arseniy Krasnov" <AVKrasnov@sberdevices.ru>,
	"Chen-Yu Tsai" <wens@kernel.org>,
	"Jernej Skrabec" <jernej.skrabec@gmail.com>,
	"Samuel Holland" <samuel@sholland.org>,
	"Thomas Gleixner" <tglx@kernel.org>,
	"Vitaly Wool" <vitalywool@gmail.com>,
	"David Woodhouse" <dwmw2@infradead.org>,
	"Russell King" <rmk+kernel@arm.linux.org.uk>,
	"David Woodhouse" <David.Woodhouse@intel.com>,
	"Mike Rapoport" <rppt@kernel.org>,
	"Maxime Coquelin" <mcoquelin.stm32@gmail.com>,
	"Alexandre Torgue" <alexandre.torgue@foss.st.com>,
	"Christophe Kerello" <christophe.kerello@st.com>,
	"Jason Roberts" <jason.e.roberts@intel.com>,
	"Michal Simek" <michal.simek@amd.com>,
	"Boris Brezillon" <boris.brezillon@collabora.com>,
	"Mason Yang" <masonccyang@mxic.com.tw>,
	"Ramuthevar Vadivel Murugan"
	<vadivel.muruganx.ramuthevar@linux.intel.com>,
	"Stefan Agner" <stefan@agner.ch>, "Lucas Stach" <dev@lynxeye.de>,
	"Thierry Reding" <thierry.reding@kernel.org>,
	"Jonathan Hunter" <jonathanh@nvidia.com>,
	"Dmitry Osipenko" <digetx@gmail.com>,
	"Matthias Brugger" <matthias.bgg@gmail.com>,
	"AngeloGioacchino Del Regno"
	<angelogioacchino.delregno@collabora.com>,
	"Jorge Ramirez-Ortiz" <jorge.ramirez@oss.qualcomm.com>,
	"Heiko Stuebner" <heiko@sntech.de>,
	"Yifeng Zhao" <yifeng.zhao@rock-chips.com>,
	"Nicolas Ferre" <nicolas.ferre@microchip.com>,
	"Alexandre Belloni" <alexandre.belloni@bootlin.com>,
	"Claudiu Beznea" <claudiu.beznea@tuxon.dev>,
	"Keguang Zhang" <keguang.zhang@gmail.com>,
	"Jacky Huang" <ychuang3@nuvoton.com>,
	"Shan-Chun Hung" <schung@nuvoton.com>,
	"Frank Li" <Frank.Li@nxp.com>,
	"Sascha Hauer" <s.hauer@pengutronix.de>,
	"Pengutronix Kernel Team" <kernel@pengutronix.de>,
	"Fabio Estevam" <festevam@gmail.com>, "Han Xu" <han.xu@nxp.com>,
	"Liang Yang" <liang.yang@amlogic.com>,
	"Neil Armstrong" <neil.armstrong@linaro.org>,
	"Kevin Hilman" <khilman@baylibre.com>,
	"Jerome Brunet" <jbrunet@baylibre.com>,
	"Martin Blumenstingl" <martin.blumenstingl@googlemail.com>,
	"Manivannan Sadhasivam" <mani@kernel.org>,
	"Kamal Dasu" <kamal.dasu@broadcom.com>,
	"Broadcom internal kernel review list"
	<bcm-kernel-feedback-list@broadcom.com>,
	"Vladimir Zapolskiy" <vz@mleia.com>,
	"Piotr Wojtaszczyk" <piotr.wojtaszczyk@timesys.com>,
	"Paul Cercueil" <paul@crapouillou.net>,
	"Harvey Hunt" <harveyhuntnexus@gmail.com>,
	"Maxim Levitsky" <maximlevitsky@gmail.com>,
	"Michael Walle" <michael@walle.cc>,
	"Srinivas Kandagatla" <srini@kernel.org>
Cc: "Tze Yee Ng" <tze.yee.ng@altera.com>,
	linux-mtd@lists.infradead.org, linux-sunxi@lists.linux.dev,
	imx@lists.linux.dev, linux-amlogic@lists.infradead.org,
	Frank.Li@kernel.org, wsa+renesas@sang-engineering.com
Subject: Re: [PATCH 51/58] mtd: rawnand: mpc5121: retain chip state across removal
Date: Sat, 07 Nov 2026 20:48:02 +0000	[thread overview]
Message-ID: <sashiko-outbox-203327@kernel.org> (raw)
In-Reply-To: <20261107-submit-rawnand-retained-handle-lifetime-v1-v1-51-0181ef0cc4c8@gmail.com>

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] mtd: rawnand: mpc5121: missing Fixes trailer for probe leak and
  removal UAF
--

commit 648cd21cc2eac3c4001033a11e9ac4de646c25b6
Author: James Hilliard <james.hilliard1@gmail.com>

> mtd: rawnand: mpc5121: retain chip state across removal
>
> Drain NAND access before unmapping the external chip-select registers.
> Keep the embedded chip and controller alive until the final MTD
> reference, and unwind scanned NAND state on unsupported geometry and
> publication failure.
>
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

[Severity: Low]
This fixes a probe-time leak of nand_scan() allocations and a
use-after-free on device removal while MTD handles remain open, both
present since the driver was added.  Should it include a Fixes: tag?

  Fixes: bb315f749f8c ("mtd: nand: Add MPC5121 NAND Flash Controller driver")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107-submit-rawnand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com?part=51