Re: [PATCH] pinctrl: qcom: fix a use-after-free bug in system shutdown path

[Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>]

On 11/5/26 5:09 PM, Bartosz Golaszewski wrote:
> msm_pinctrl_probe() allocates the pctrl structure via devm_kzalloc() and
> unconditionally populates the global variables poweroff_pctrl and
> pm_power_off.
> 
> If msm_pinctrl_probe() subsequently fails, devres resources - including
> the memory allocated for pctrl - are automatically freed. However, the
> global pointers are never cleared, resulting in a use-after-free during
> kernel_power_off().
> 
> Schedule a devres action clearing the global pointers that runs before
> the pctrl memory is freed.
> 
> Cc: stable@vger.kernel.org
> Closes: https://sashiko.dev/#/bug/linux-0c3a18a4-3de8-489b-abc9-e9e3a8641ed2
> Fixes: ad64498762dd ("pinctrl: qcom: Hook pm_power_down for shutdown support")
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad