Re: [PATCH v3 3/8] pinctrl: qcom: Register functions before enabling pinctrl

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free in system power-off path if probe fails
--

commit 7e913e496347a43b567ce3ce3e00954f1fc74caf
Author: Alexandre MINETTE <contact@alex-min.fr>

pinctrl: qcom: Register functions before enabling pinctrl

This commit changes the Qualcomm pinctrl initialization sequence to register
functions before enabling the controller. It replaces devm_pinctrl_register()
with devm_pinctrl_register_and_init() and an explicit pinctrl_enable() call.

> diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
> index 45b3a2763eb85..a2a1e0835735d 100644
> --- a/drivers/pinctrl/qcom/pinctrl-msm.c
> +++ b/drivers/pinctrl/qcom/pinctrl-msm.c
[ ... ]
> @@ -1607,6 +1607,11 @@ int msm_pinctrl_probe(struct platform_device *pdev,
>  			return ret;
>  	}
>  
> +	ret = pinctrl_enable(pctrl->pctrl);
> +	if (ret)
> +		return dev_err_probe(&pdev->dev, ret,
> +				     "Couldn't enable pinctrl driver\n");

This isn't a regression strictly introduced by this patch, but it adds a
new failure path that could trigger an existing issue.

Earlier in msm_pinctrl_probe(), msm_pinctrl_setup_pm_reset() is called,
which assigns the devm-allocated pctrl to the global poweroff_pctrl pointer
and sets the global pm_power_off callback.

If pinctrl_enable() fails, the probe function aborts and the devm framework
will automatically free the pctrl memory. However, there is no corresponding
teardown to clear the global pm_power_off callback or poweroff_pctrl pointer.

If the system is later powered off, could the kernel invoke the callback and
dereference the freed poweroff_pctrl pointer?

> +
>  	ret = msm_gpio_init(pctrl);
>  	if (ret)
>  		return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260519-mainline-send-v1-sending-v3-0-3dd7aa125353@alex-min.fr?part=3