Re: [PATCH v6 4/7] nvmem: layouts: add Microchip/SST SFDP EUI layout driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Module unload leads to a Use-After-Free (UAF) due to a dangling `read_post_process` callback because NVMEM layout cells are not dynamically unregistered.
--

--- Patch [4]: [PATCH v6 4/7] nvmem: layouts: add Microchip/SST SFDP EUI layout driver ---
commit 16c236b381f7d2d9225ab89076bcd39b341f60db
Author: Manikandan Muralidharan <manikandan.m@microchip.com>

nvmem: layouts: add Microchip/SST SFDP EUI layout driver

Add an NVMEM layout that exposes the factory-programmed EUI-48 identifier
from the Microchip/SST vendor SFDP parameter table as a mac-address cell.

> diff --git a/drivers/nvmem/layouts/sst26vf-sfdp-eui.c b/drivers/nvmem/layouts/sst26vf-sfdp-eui.c
> new file mode 100644
> index 0000000000000..641318d6f0af6
> --- /dev/null
> +++ b/drivers/nvmem/layouts/sst26vf-sfdp-eui.c
[ ... ]
> +static void sfdp_eui_remove(struct nvmem_layout *layout)
> +{
> +	nvmem_layout_unregister(layout);
> +}

[Severity: High]
This isn't a bug introduced by this patch, but it exposes a pre-existing
architectural flaw in the NVMEM core.

Since this driver can be built as a module, what happens when it is unloaded?

Looking at the NVMEM core, nvmem_layout_unregister() is an empty stub. It
does not actually unregister the cells or remove their sysfs interfaces.

If a user reads the NVMEM cell via sysfs after this module is unloaded, the
core calls __nvmem_cell_read(), which dereferences the now-dangling
sfdp_eui_read_post_process callback pointer, resulting in a use-after-free.

Should this driver be restricted to a built-in driver until the NVMEM core
properly implements layout unregistration?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729043026.1811147-1-manikandan.m@microchip.com?part=4