Re: [PATCH v3] mtd: maps: add INT0800 firmware-flash map driver

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mtd: maps: Use-After-Free in int0800 via sysfs driver unbind
--

commit 2d904c4a0ae5009245dd1587c804f0ac6e9402b8
Author: Stephen Bancroft <stevereaver@xxxxxxxxx>

mtd: maps: add INT0800 firmware-flash map driver

Adds a read-only MTD mapping driver that binds the ACPI INT0800 device and
exposes the system firmware flash as an MTD ROM device.

> diff --git a/drivers/mtd/maps/int0800.c b/drivers/mtd/maps/int0800.c
> new file mode 100644
> index 0000000000000..0188d58b168d9
> --- /dev/null
> +++ b/drivers/mtd/maps/int0800.c

[ ... ]

> +static void int0800_remove(struct platform_device *pdev)
> +{
> +	struct int0800 *fw = platform_get_drvdata(pdev);
> +
> +	mtd_device_unregister(fw->mtd);
> +	map_destroy(fw->mtd);
> +}

[Severity: High]
Can this lead to a use-after-free and unmapped memory dereference if a
user forces a driver unbind via sysfs while the character device is still
open?

If a privileged user opens /dev/mtdX and then writes to
/sys/bus/platform/drivers/int0800/unbind, int0800_remove() is invoked.
This unconditionally calls map_destroy(fw->mtd), freeing the mtd_info
structure and allowing devres to unmap fw->map.virt.

Since mtdchar_open() incrementing the module use-count does not prevent
forced sysfs unbinds, a subsequent read() on the still-open file
descriptor would dereference the freed mtd_info and read from the
unmapped memory.

Should this driver set .suppress_bind_attrs = true in the platform_driver
to prevent forced sysfs unbinds?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921021459.283023-1-stevereaver@xxxxxxxxx?part=1