Re: [PATCH v8 5/8] nvmem: layouts: add Microchip/SST SFDP EUI layout driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] nvmem: use-after-free on layout driver module unload
--

commit 4e7e82e84f19ca0cc7f7eae9477c171b2bdab685
Author: Manikandan Muralidharan <manikandan.m@microchip.com>

nvmem: layouts: add Microchip/SST SFDP EUI layout driver

This commit adds an NVMEM layout that exposes the factory-programmed
EUI-48 identifier from the Microchip/SST vendor SFDP parameter table
as a "mac-address" cell.

> diff --git a/drivers/nvmem/layouts/sst26vf-sfdp-eui.c b/drivers/nvmem/layouts/sst26vf-sfdp-eui.c
> new file mode 100644
> index 0000000000000..641318d6f0af6
> --- /dev/null
> +++ b/drivers/nvmem/layouts/sst26vf-sfdp-eui.c

[ ... ]

> +	info.name = "mac-address";
> +	info.offset = base + SFDP_MCHP_EUI48_OFFSET;
> +	info.bytes = ETH_ALEN;
> +	info.np = of_get_child_by_name(layout_np, "mac-address");
> +	info.read_post_process = sfdp_eui_read_post_process;
> +
> +	ret = nvmem_add_one_cell(nvmem, &info);

[ ... ]

> +static void sfdp_eui_remove(struct nvmem_layout *layout)
> +{
> +	nvmem_layout_unregister(layout);
> +}

[Severity: High]
Does this leave a dangling pointer if the layout module is unloaded?

In sfdp_eui_add_cells(), the driver registers sfdp_eui_read_post_process() as
a callback via nvmem_add_one_cell(). However, the NVMEM core tracks the
provider device's module, not the layout driver module. 

Furthermore, nvmem_layout_unregister() is an empty stub in the NVMEM core.
Because the core API does not remove the cells, the cell remains in the
NVMEM device's cell list with a dangling read_post_process function pointer.

If the layout module is unloaded and the cell is subsequently read (e.g.,
via sysfs), could this execute unmapped module memory and cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1790847519.git.manikandan.m@microchip.com?part=5