Re: [PATCH net-next v3 2/2] net: pse-pd: add Realtek/Broadcom PSE MCU driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect module owner assignment in `rtpse_mcu_register` allows the transport module to be unloaded while active, leading to Use-After-Free.
--

commit 7bb530c7721986789a60e3b5029b0d7f2ddc58d4
Author: Jonas Jelonek <jelonek.jonas@gmail.com>

net: pse-pd: add Realtek/Broadcom PSE MCU driver

This commit adds a driver for the microcontroller that fronts Realtek and
Broadcom PSE chips. It splits the implementation into a shared core module
and separate I2C and UART transport modules.

> diff --git a/drivers/net/pse-pd/realtek-pse-mcu-core.c b/drivers/net/pse-pd/realtek-pse-mcu-core.c
> new file mode 100644
> index 0000000000000..718788d13d90e
> --- /dev/null
> +++ b/drivers/net/pse-pd/realtek-pse-mcu-core.c

[ ... ]

> +int rtpse_mcu_register(struct rtpse_mcu_ctrl *pse)
> +{

[ ... ]

> +	/*
> +	 * Depending on the MCU firmware configuration (which might be different
> +	 * for every board), it isn't known whether the PoE subsystem is active or
> +	 * inactive by default. At this stage, the PSE chips might already deliver
> +	 * power to PDs without any explicit enable.
> +	 */
> +
> +	pse->pcdev.owner    = THIS_MODULE;
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[Severity: High]
Does this assign the core module as the owner instead of the calling transport
module? Since this executes in realtek-pse-mcu-core.c, THIS_MODULE resolves
to the core module, leaving the transport module (e.g., realtek-pse-mcu-i2c)
unpinned.

When a consumer gets a reference to the PSE controller, it pins the core
module, but an administrator can still unload the active transport module.
Unloading the transport module triggers device unbinding and devm resource
cleanup, which frees the pse structure while it is still active, leading to
a use-after-free on subsequent PSE operations.

> +	pse->pcdev.ops      = &rtpse_mcu_ops;
> +	pse->pcdev.dev      = pse->dev;
> +	pse->pcdev.types    = ETHTOOL_PSE_C33;
> +	pse->pcdev.nr_lines = info.max_ports;
> +	pse->pcdev.pis_prio_max = RTPSE_MCU_PORT_MAX_PRIORITY;
> +	pse->pcdev.supp_budget_eval_strategies = PSE_BUDGET_EVAL_STRAT_DYNAMIC;
> +
> +	return devm_pse_controller_register(pse->dev, &pse->pcdev);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260628222705.4052815-1-jelonek.jonas@gmail.com?part=2