Re: [PATCH v22 08/13] mfd: core: Add firmware-node support to MFD cells

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free due to incorrect lifecycle management of non-OF fwnodes using devm_add_action.
--

commit 346fbcb3dbf6a1ca28eec9135059c21e18423182
Author: Shivendra Pratap <shivendra.pratap@oss.qualcomm.com>

mfd: core: Add firmware-node support to MFD cells

This commit extends struct mfd_cell with a callback to allow drivers to
provide an explicit firmware node. The node is assigned to the MFD child
device during registration if one is not assigned by other matching
mechanisms.

> diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
> --- a/drivers/mfd/mfd-core.c
> +++ b/drivers/mfd/mfd-core.c

[ ... ]

> @@ -224,6 +231,29 @@ static int mfd_add_device(struct device *parent, int id,

[ ... ]

> +			/*
> +			 * platform_device_release() drops only of_node refs.
> +			 * Track non-OF fwnodes explicitly so they are put on
> +			 * all teardown paths.
> +			 */
> +			if (!to_of_node(fwnode)) {
> +				ret = devm_add_action(&pdev->dev,
> +						      mfd_child_fwnode_put,
> +						      fwnode);

Is it safe to tie the fwnode lifetime to the driver bind and unbind
lifecycle using devm_add_action() here?

Since devres managed resources are released when a driver unbinds, if a
driver binds to this MFD child device and is later unbound via sysfs,
device_unbind_cleanup() will call devres_release_all(). This triggers
mfd_child_fwnode_put() and drops the reference, freeing the underlying memory
while the device still has its fwnode pointer populated.

Could a subsequent driver rebind trigger a use-after-free when accessing
the dropped fwnode?

Also, during device removal, device_del() calls devres_release_all() before
emitting the KOBJ_REMOVE uevent. The platform bus uevent handler then accesses
the fwnode:

device_del()
   devres_release_all(dev)
   kobject_uevent(&dev->kobj, KOBJ_REMOVE)
      platform_uevent()
         acpi_device_uevent_modalias()
            ACPI_COMPANION(dev)

Will evaluating ACPI_COMPANION() access dev->fwnode after it has already
been freed by devres_release_all(), causing a use-after-free during
standard device teardown?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260514-arm-psci-system_reset2-vendor-reboots-v22-0-28a5bde07483@oss.qualcomm.com?part=8