Re: [PATCH v5 5/8] firmware: raspberrypi: register nvmem driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Lockless access to `platform_get_drvdata` in `rpi_firmware_get` leads to a TOCTOU Use-After-Free race with driver unbind.
--

commit 4d3a36b9dad7b2f3acf0486917ea6908b89eb46f
Author: Gregor Herburger <gregor.herburger@linutronix.de>

firmware: raspberrypi: register nvmem driver

The Raspberry Pi firmware exposes two regions with otp registers. The
first region called "customer otp" is available on all Raspberry Pi
models. The second is only available on the Raspberry Pi 5 (bcm2712).

> diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
> index 0aa322e9a2e73..e24636feae0ea 100644
> --- a/drivers/firmware/raspberrypi.c
> +++ b/drivers/firmware/raspberrypi.c

[ ... ]

> @@ -327,12 +373,23 @@ static void rpi_firmware_remove(struct platform_device *pdev)
>  	rpi_hwmon = NULL;
>  	platform_device_unregister(rpi_clk);
>  	rpi_clk = NULL;
> +	platform_device_unregister(rpi_otp_customer);
> +	rpi_otp_customer = NULL;
> +	platform_device_unregister(rpi_otp_private);
> +	rpi_otp_private = NULL;
>  
>  	rpi_firmware_put(fw);

[Severity: High]
This isn't a bug introduced by this patch, but I wanted to ask about a
potential pre-existing race condition here with driver unbind.

When the driver is unbound (e.g., via sysfs), rpi_firmware_remove() is
called, which drops the reference count here and frees the firmware object.

Could a concurrent call to rpi_firmware_get() retrieve the fw pointer via
platform_get_drvdata() without holding the device_lock before the drvdata
is cleared?

If rpi_firmware_get() does not serialize with driver unbind, would it be
possible for it to execute kref_get_unless_zero() after the firmware
object has already been freed by rpi_firmware_put(), leading to a
use-after-free?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260520-rpi-otp-driver-v5-0-b26e5908eeac@linutronix.de?part=5