Re: [PATCH v9 3/9] pinctrl: cs42l43: Use fw_devlink_set_device()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver overwrites the platform device's fwnode and devlink device pointer during probe, but fails to restore them on probe failure or driver unbind, leading to a Use-After-Free.
--

--- Patch [3]: [PATCH v9 3/9] pinctrl: cs42l43: Use fw_devlink_set_device() ---
commit 80d27bc87210331a635e646eedd21068256104a4
Author: Herve Codina <herve.codina@bootlin.com>

pinctrl: cs42l43: Use fw_devlink_set_device()

This patch updates the CS42L43 pinctrl driver to use the dedicated
fw_devlink_set_device() helper instead of directly modifying the fwnode->dev
field.

> diff --git a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
> index 8990fab0446cf..563070aba3d81 100644
> --- a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
> +++ b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
> @@ -576,7 +576,7 @@ static int cs42l43_pin_probe(struct platform_device *pdev)
>  				return ret;
>  
>  			if (!child->dev)
> -				child->dev = priv->dev;
> +				fw_devlink_set_device(child, priv->dev);

[Severity: High]
This isn't a bug introduced by this patch, but could this setup leave a dangling
pointer that leads to a use-after-free on unbind?

If the device is instantiated via a Device Tree overlay, the driver fetches the
child node, takes a reference to it, and registers a devres action
(cs42l43_fwnode_put) to drop this reference on teardown.

Later in cs42l43_pin_probe(), the driver calls:

    device_set_node(priv->dev, fwnode);

This overwrites the platform device's fwnode with the child node without taking
an additional reference.

If the driver is unbound manually via sysfs or fails probe, the devres action
drops the driver's reference to the child node, but pdev->dev.fwnode is left
pointing to it. If the DT overlay is then removed, the OF core detaches the
node, causing the child node to be freed.

Finally, the OF core notifier triggers platform device removal, and
device_del() attempts to access dev->fwnode->dev to clear the devlink,
dereferencing the freed child node. 

Does this require a cleanup action to restore the original fwnode and devlink
device pointer on teardown?

>  			fwnode = child;
>  		}
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708100302.517792-1-herve.codina@bootlin.com?part=3