From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f54.google.com (mail-dl1-f54.google.com [74.125.82.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89F98DDC5 for ; Sat, 21 Feb 2026 01:01:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771635715; cv=none; b=DIH9XMwKfzzoEOCadED7Ddo99pDHkc/gyzuu3+u6hJkTqJvxu6KLoBYNK+6mtTNgbyYfYaGSCgbpiJLs3xTRGjVq7dbwyQPoi8NmWRfd7SmcnPXYr4GMot4alVVSkHGOJY3NQJ/CVvZdkeioQJt1INz2yU61PyNx2W+NSjDeGGk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771635715; c=relaxed/simple; bh=hz/4i9iE8lXIVUZFO4pfCP1B0S2I18vOBi20u/9kd44=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=WXNnkGDbw3NLpVuBuctQejhnzkrPRxb5VJBfmYdvFBJfYO5A+Y9zSzm2Ix3AxZ0fXm04WZF2GP56IruwxNyMpiKv3+nPwPHfXOoC2Iif08MKx2h/S7pVBG40xWwWpoLl+zTSMCRHHD31Pr2KWYicmFs6p4FRTUMEJgriA6svbAY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cnhfOdnw; arc=none smtp.client-ip=74.125.82.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cnhfOdnw" Received: by mail-dl1-f54.google.com with SMTP id a92af1059eb24-12758ce1e8dso1226380c88.0 for ; Fri, 20 Feb 2026 17:01:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771635714; x=1772240514; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=887Q6Bd0WisWLv8o7hwzu84EYKbeJEL6+m7UMSOqUCI=; b=cnhfOdnwo5L09QHfJFXvjDtr+k8qKcFs08bK+YdPvjVoDKxxGyyLE1qBEfTpWFBR8l TzpsMeSJ6htZeyLqw5PN7WRXhmLa2p4vbVmuV+N7A8/ofSyXF8kXjKbD68OrX2ST53AE iF/GbBrVqb+kETYLIQMnF2jwtPua5l98Rbz8Zq7s/JxHCXQsCYtvLaKtnsD/I/bLC1RU yDHdKoTDpJJSyA8zavqafrmwPSvp+VjpkKrZUGK2WcKkV4oSukl3L5o9as9M1bBotnjj OmJlknMozpXZSepZg/0fp0RYUMYKiROBVna9D2o1uWOmQ1Mr1ZkJ2pBiKC9fYbGzRmjJ HIDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771635714; x=1772240514; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=887Q6Bd0WisWLv8o7hwzu84EYKbeJEL6+m7UMSOqUCI=; b=sNRotUz4RUVlmyUMGwDdUl66/jXg5NIcnK/EW9gzUvOviKLQuTlsbRamhdz3NYtpBf jmVRDZtbzNpTcPxmPR39MF3gHDv109IMYDK5Ru1DA21TqT/Y1mO1QMnoiaLlgSMbmxVs cS9nnVqFfTvHGPTxzIg76zluvhlq1D32h1PcmQmN26ZaXrKpisbNcq+67TCNO9wqNtF4 HTPwF4iaVrQah+BH4DLxc3c4k0hBPvEmozCu1SuBF5IIrWVlXgSAxb/fb86EyYRKcT+n YwWVW4uPSmfs2moEFLVC6Odr32Bci0vOD22HJP1ZqaHx94eoboWVabRZG8V6g5a4IVZH H/tw== X-Forwarded-Encrypted: i=1; AJvYcCWpebXBN4QzVfKCUCoNL3Dr0Wh2Tu99kCUOF9raQsuYgolOYRy6VE73Z1Rd234PaPBagiAkJ557hZTBf4Y=@vger.kernel.org X-Gm-Message-State: AOJu0YwoBOw5lTe1Uqth29j+Z2J9HEgD/WzEUILvwWMfMOlLkgsvwluM gwnjIfBKTBW6GZLL9NWgMs4x48fQ5xKf10Yi2LtiFbla9DhCUxNgLtle X-Gm-Gg: AZuq6aKwD41rJx9z+e3pTBzyQavyO0QYVU6fXLy9qdc8xTaAkPJ2UpTulJxcCXCgP8H zdzYFz8FCymC+xtIx0FQ/rt7e/cvZGCOsjF7XSyO/y8sq8dg0JZ+fWlWNNZxsq3PwCt2/mizMto pc/xUcf4xeR2RMDm4SxhR2VPqE08CkB61ExS+vJCaZJ+BJo9DVGrDhyem4LIx+XDYYbJZ269BvC MQce4o/bHx0yDieH3C2jA51tFSxxisXfa6PhOUh5ipmzfDpLZKx0TwuGn/XvhiZJudipx9mMTDJ MqPeWBQ+x1FGoC574uOsTB5Lk96eaCOkT0OF06J2bzBEtPeSH6x/0XTKNnR3iJO1fYBEJzhy++3 P+7WfwNTPj3T0C4uTfLGQOjbOUsTqnhEiEfDz3OKBoOeJlnzi8or1Nej5GrBSZdKpRJOQR2+oeY XB4FVT0BbFKQH892BaVJxFc3I5R7vocLEQf9gUJsvckUFnJoxIW6UQfIrBY9PC8hkX X-Received: by 2002:a05:7022:786:b0:11e:70d8:5dbb with SMTP id a92af1059eb24-1276acda6e7mr713501c88.7.1771635713544; Fri, 20 Feb 2026 17:01:53 -0800 (PST) Received: from google.com ([2a00:79e0:2ebe:8:30e0:64af:2b48:14be]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1276af8ac3fsm914502c88.13.2026.02.20.17.01.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Feb 2026 17:01:53 -0800 (PST) Date: Fri, 20 Feb 2026 17:01:50 -0800 From: Dmitry Torokhov To: Vinod Koul , Kishon Vijay Abraham I Cc: Neil Armstrong , "Rafael J. Wysocki" , Geert Uytterhoeven , Johan Hovold , Claudiu Beznea , "Dr. David Alan Gilbert" , Peter Griffin , Dmitry Baryshkov , Krzysztof Kozlowski , Zijun Hu , linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] phy: core: fix potential UAF in of_phy_simple_xlate() Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Thu, Feb 19, 2026 at 04:11:37PM -0800, Dmitry Torokhov wrote: > On Thu, Feb 19, 2026 at 03:57:11PM -0800, Dmitry Torokhov wrote: > > The implementation put_device()s located device and then uses > > container_of() on the pointer. The device may disappear by that time, > > resulting in UAF. > > > > Fix the problem by keeping the reference to the framer device, > > avoiding getting an extra reference to it in framer_get(), and making > > sure to drop the reference in error path when we fail to get the module. > > Hmm, I was too rash. There are bunch of other xlate functions that need > to be updated to take the reference. So I am convinced that xlate functions need to bump up the reference to phy devices they return. The question is how to deal with the ones that do not. I can either convert them in the same patch (the changes are quite mechanical) or we can do the whole song and dance, introduce a flag, set it up in converted xlate functions, have the core respect it, and then remove it from xlates and from the core when it is all done. Please let me know. Thanks. -- Dmitry