[PATCH 02/58] nvmem: retain provider context through final device release

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] nvmem: unpinned module callback execution in nvmem_release()
--

commit 6223a607fc304676fa9e070c9a5930603931e0e7
Author: James Hilliard <james.hilliard1 at gmail.com>

nvmem: retain provider context through final device release

This commit adds optional priv_get() and priv_put() callbacks to struct
nvmem_config so providers can retain their private context until final
device release in nvmem_release().

> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 0556d140170a4..851fa5cabecb2 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -541,6 +541,8 @@ static void nvmem_release(struct device *dev)
>  
>  	ida_free(&nvmem_ida, nvmem->id);
>  	gpiod_put(nvmem->wp_gpio);
> +	if (nvmem->ops->priv_put)
> +		nvmem->ops->priv_put(nvmem->priv);
>  	kfree(nvmem->ops);
>  	kfree(nvmem);
>  }

[Severity: Medium]
Can executing nvmem->ops->priv_put() here race with module unload and run
unmapped module text?

The kernel-doc note in include/linux/nvmem-provider.h states that the
callbacks must retain any module needed to execute priv_put() until it
returns, and commit "mtd: add opt-in lifetime ownership for backing
objects" implements this by calling __module_get(THIS_MODULE) in
mtd_otp_nvmem_get() and module_put(THIS_MODULE) in mtd_otp_nvmem_put().
However, a callback in a loadable module cannot safely drop the last
reference to its own module before returning:

CPU0                              CPU1
nvmem_release()
  mtd_otp_nvmem_put()
    module_put(THIS_MODULE)
                                  delete_module()
                                    free_module()
    return;  <-- use-after-free

nvmem->owner is only held by active consumers and is already dropped in
nvmem_device_put() before nvmem_release() runs.  The NVMEM core should pin
the module owning priv_put() in nvmem_register() and call module_put() in
nvmem_release() after nvmem->ops->priv_put() returns.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107-submit-rawnand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com?part=2