Re: [PATCH next] firmware: imx: fix use after free in init_device_context()

[Dan Carpenter <error27@gmail.com>]

On Tue, May 19, 2026 at 06:40:50AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:
> - [Critical] Unlocking `dev_ctx->fops_lock` after `dev_ctx` has been freed in `se_if_fops_close`.

That's true.  There is a use after free in se_if_fops_close().  Someone
else care to fix this?

> - [Critical] Invalid `kfree()` of an error pointer initialized from `memdup_user()` causes a kernel panic.

The way I remember it, I'm the person who said that __cleanup code
needs to handle error pointers and so for as I can see it still does.

> - [Critical] Direct dereference of a user-space pointer without `copy_from_user()` in `se_chk_tx_msg_hdr()`.

Heh.  Sashiko is smoking crack.

> - [High] Concurrent modifications to the global shared list `priv->dev_ctx_list` leading to memory corruption.
> - [High] Concurrent access to shared `cmd_receiver_clbk_hdl` state in `se_ioctl` causes a memory leak and state corruption.
> - [High] The `.release` file operation uses an interruptible mutex lock, permanently leaking resources if interrupted.
> --

regards,
dan carpenter