From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794083364; b=uaGjmgvMuh3xZ/1dbdY3kTmaPvrHZ1EBx7LK4RbPc9L/UQ8GsaH+IeKelHZrOu/Pk6ru WwE/1IU2JjOHThFc3DBKasEYTzkFckUN7V7YraTUEWCvk1FCVLdUYYB2FD9VJw21aBl2R ggUOjoeZ0TXbQ7Oxw56JwaFH4/XBmGEbIVBzIo5V5U52pAmOCVeVgLGcSIlBTlVDfR/3E +ZUWdx3Kj7/as5oSHSjetdmyMb+OyT9iI8ds/lL1/hRnTBqDn9L3xVAVp6lrfgPxLS7Ri GXt0bc+F7WbFOMWvLtvCfqmryjzWFiTyVIkjFiXLw9kIyvw4hE148T/GPKsBg0neP8g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794083364; h=Received:DKIM-Signature:Message-ID:From:Subject:Reply-To:To:Cc: In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=1fsl7JZFQyXxjjK/JE+evV8C5FWEAhsAMXLZmVGmCpg=; b=CvTdTfpCuTO2sMtSDLTugg3piI8d1xt65DX1zPL49g3Vhyk7/T5c9DMYtxuIrbcjQMhO BdcwClks7JYK2T0Xvap44qrN3Um+EkEW6tUbJYkA3TE5LLfUDH/uodt2nUrk4eAn7wp+B Z+/QzYBDjM6BuG+peIpwE6+dj1//Jw1Fhwa21KbifN1AVhQNHUBE08zYqBBSKDFWyqJfm kCZzHwcpKKN/P6BhVMjz3tN3uwZMrIKdLX+vDdIcD0Slq1k9DJQ1x4rMZqRgr7SFd4Qmx BIZhAPECRAZQ8D2lTBV0s/tLN5fMN6Yv3IQqYn8nnuujuswHSmCz2rtI7DAnkhqbH+g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=nlH26Vkp; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F311606A326; Sat, 7 Nov 2026 20:29:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=nlH26Vkp Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58E6C1F0089F; Sat, 7 Nov 2026 20:29:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794083364; bh=1fsl7JZFQyXxjjK/JE+evV8C5FWEAhsAMXLZmVGmCpg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=nlH26Vkpn+Lby4qxfU9i9cpb9x2w9zz4rXIYGMpzjWzF7zLTTgjjzQsoKbdqC/qMY JsAu6C9nmcjeWt+JU8qdUIu1jrzXolJzXSsAS6Ld4+LYwxg9XlCpLd8wu3aqmiit+h WVO5XvrNrfHl182Qwyi9aokvmIBN7ntjxnJ1NpsT6svuBWzJKgQqyeEOKi8+dpVRZN jPYRQel82BUr9Y1mxI3J1H39f7Z6b8QT/iOlKSii2jvn+jn41zyBbnHv/Dy3i7tkAC JlXh4bUOZCUfBZrU9g922Ax2Q4SrbfNL6jwGt36BqcuLgKRBeH57gH5rjKC338H/+e rpn/3Nu0pYZBw== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH 19/58] mtd: rawnand: orion: retain open-handle state on removal Reply-To: sashiko-reviews@lists.linux.dev To: "James Hilliard" , "Miquel Raynal" , "Richard Weinberger" , "Vignesh Raghavendra" , "Brian Norris" , "Boris Brezillon" , "Arseniy Krasnov" , "Chen-Yu Tsai" , "Jernej Skrabec" , "Samuel Holland" , "Thomas Gleixner" , "Vitaly Wool" , "David Woodhouse" , "Russell King" , "David Woodhouse" , "Mike Rapoport" , "Maxime Coquelin" , "Alexandre Torgue" , "Christophe Kerello" , "Jason Roberts" , "Michal Simek" , "Boris Brezillon" , "Mason Yang" , "Ramuthevar Vadivel Murugan" , "Stefan Agner" , "Lucas Stach" , "Thierry Reding" , "Jonathan Hunter" , "Dmitry Osipenko" , "Matthias Brugger" , "AngeloGioacchino Del Regno" , "Jorge Ramirez-Ortiz" , "Heiko Stuebner" , "Yifeng Zhao" , "Nicolas Ferre" , "Alexandre Belloni" , "Claudiu Beznea" , "Keguang Zhang" , "Jacky Huang" , "Shan-Chun Hung" , "Frank Li" , "Sascha Hauer" , "Pengutronix Kernel Team" , "Fabio Estevam" , "Han Xu" , "Liang Yang" , "Neil Armstrong" , "Kevin Hilman" , "Jerome Brunet" , "Martin Blumenstingl" , "Manivannan Sadhasivam" , "Kamal Dasu" , "Broadcom internal kernel review list" , "Vladimir Zapolskiy" , "Piotr Wojtaszczyk" , "Paul Cercueil" , "Harvey Hunt" , "Maxim Levitsky" , "Michael Walle" , "Srinivas Kandagatla" Cc: "Tze Yee Ng" , linux-mtd@lists.infradead.org, linux-sunxi@lists.linux.dev, imx@lists.linux.dev, linux-amlogic@lists.infradead.org, Frank.Li@kernel.org, wsa+renesas@sang-engineering.com In-Reply-To: <20261107-submit-rawnand-retained-handle-lifetime-v1-v1-19-0181ef0cc4c8@gmail.com> References: <20261107-submit-rawnand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com> <20261107-submit-rawnand-retained-handle-lifetime-v1-v1-19-0181ef0cc4c8@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sat, 07 Nov 2026 20:29:20 +0000 X-Mailing-List: imx@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Thank you for your contribution! Sashiko AI review found 1 potential issue to consider: - [Low] mtd: rawnand: orion: missing Fixes trailer for removal UAF fix -- commit 9465d514f949c22e40663ef5664153c0883e1d59 Author: James Hilliard > mtd: rawnand: orion: retain open-handle state on removal > > Keep chip metadata and controller storage alive until the final MTD > reference is released. Unregister and disconnect each published chip > before releasing the resources used by its hardware operations. > > Retain the embedded chip and its copied name through the shared > allocation. > > Signed-off-by: James Hilliard [Severity: Low] This fixes a use-after-free when the device is removed while MTD handles remain open, which has been present since the driver was introduced. Should it include a Fixes tag? Fixes: 2a1dba2931dc ("[MTD] [NAND] Marvell Orion device bus NAND controll= er") --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261107-submit-raw= nand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com?part=3D19