Re: [PATCH v8 5/9] block: implement NVMEM provider

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The NVMEM provider incorrectly sets `config.owner = THIS_MODULE`, failing to pin the underlying block device driver module and causing a Use-After-Free if the driver module is unloaded while a consumer holds an NVMEM cell.
--

commit 658c388a96462e54e252d777f2fc96dcf4f36d59
Author: Daniel Golle <daniel@makrotopia.org>

block: implement NVMEM provider

This patch allows block devices or partitions to act as NVMEM providers,
exposing factory-provisioned data such as MAC addresses or Wi-Fi calibration
blobs. It introduces blk_nvmem_add to register the block device with the
NVMEM framework when the appropriate device tree nodes are present.

> diff --git a/block/blk-nvmem.c b/block/blk-nvmem.c
> new file mode 100644
> index 0000000000000..642a12f8a8b1c
> --- /dev/null
> +++ b/block/blk-nvmem.c

[ ... ]

> +int blk_nvmem_add(struct block_device *bdev)
> +{
> +	struct device *dev = &bdev->bd_device;
> +	struct nvmem_config config = {};
> +	struct nvmem_device *nvmem;

[ ... ]

> +	config.id = NVMEM_DEVID_NONE;
> +	config.dev = dev;
> +	config.name = dev_name(dev);
> +	config.owner = THIS_MODULE;

[Severity: High]
Should this owner be set to the block device driver's module, such as
bdev->bd_disk->fops->owner, instead of THIS_MODULE?

By setting config.owner to THIS_MODULE, it seems we pin the block core
module but fail to protect the actual block device driver (like mmc_block)
from being unloaded while a consumer still holds a reference to the NVMEM
cell. 

If the driver module is unloaded, its module memory is freed. When the
consumer later releases the cell and the bd_device refcount drops to zero,
could disk_release() end up calling disk->fops->free_disk on a now-unmapped
driver module pointer and cause a crash?

> +	config.priv = (void *)(uintptr_t)dev->devt;
> +	config.reg_read = blk_nvmem_reg_read;
> +	config.size = bdev_nr_bytes(bdev);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703-block-as-nvmem-v8-0-98ae32bfc49a@oss.qualcomm.com?part=5