Re: [PATCH v9 11/14] net: ipa: Switch to generic PAS TZ APIs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Switching to the generic PAS API breaks the hard module dependency on the PAS backend driver, exposing a TOCTOU and Use-After-Free race condition against backend module unloading.
--

commit 6d60b150886ed8cbb76a8f5f11bec8a93730899c
Author: Sumit Garg <sumit.garg@oss.qualcomm.com>
Subject: net: ipa: Switch to generic PAS TZ APIs

This commit switches the IPA client driver to use the generic PAS TZ APIs.
The change allows the driver to support multiple TrustZone implementation
backends rather than being tied specifically to the QTEE based SCM PAS
service.

> diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
> --- a/drivers/net/ipa/ipa_main.c
> +++ b/drivers/net/ipa/ipa_main.c
> @@ -624,10 +624,13 @@ static int ipa_firmware_load(struct device *dev)
>  	}
>  
>  	ret = qcom_mdt_load(dev, fw, path, IPA_PAS_ID, virt, phys, size, NULL);
> -	if (ret)
> +	if (ret) {
>  		dev_err(dev, "error %d loading \"%s\"\n", ret, path);
> -	else if ((ret = qcom_scm_pas_auth_and_reset(IPA_PAS_ID)))
> -		dev_err(dev, "error %d authenticating \"%s\"\n", ret, path);
> +	} else {
> +		ret = qcom_pas_auth_and_reset(IPA_PAS_ID);

[Severity: High]
Does switching to the generic PAS API here break the hard module dependency
on the PAS backend driver?

By removing the direct symbol dependency on qcom_scm, it appears the backend
PAS module can now be concurrently unloaded. If the backend is unloaded during
this call, could it cause a use-after-free or NULL pointer dereference?

For example:
1. ipa_firmware_load() calls qcom_pas_auth_and_reset().
2. qcom_pas_auth_and_reset() checks if (!ops_ptr).
3. The backend PAS module is concurrently unloaded, and
   qcom_pas_ops_unregister() clears ops_ptr and frees the module memory.
4. qcom_pas_auth_and_reset() dereferences the now-freed ops_ptr memory.

Before this patch, the direct symbol call to qcom_scm_pas_auth_and_reset()
forced a strict module dependency that prevented backend removal.

> +		if (ret)
> +			dev_err(dev, "error %d authenticating \"%s\"\n", ret, path);
> +	}
>  
>  	memunmap(virt);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702115835.167602-1-sumit.garg@kernel.org?part=11