Re: [PATCH v4] mtd: maps: add INT0800 firmware-flash map driver

[Steve Reaver]

The remaining removal paths don't apply to this device. The platform
device is only unregistered via ACPI_RECONFIG_DEVICE_REMOVE, which
requires the INT0800 ACPI node to leave the namespace. INT0800 is a
static DSDT device: it has no _EJ0 (the eject sysfs attribute is never
created for it), cannot live in an unloadable SSDT overlay, and has no
hotplug notify source. Unbinding a parent device/driver does not
invoke a child's remove(). With .suppress_bind_attrs the sysfs unbind
is gone, and module unload is blocked by open fds via mtd->owner. The
residual "rmmod -f with CONFIG_MODULE_FORCE_UNLOAD" bypasses
refcounting for every driver. FWIW, the underlying limitation — map
providers freeing mtd_info while the core cannot wait for open fds —
is shared by all existing drivers/mtd/maps users; addressing it would
be an MTD core lifetime change beyond this driver.

On Wed, 23 Sept 2026 at 19:41, <sashiko-bot@xxxxxxxxxx> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] mtd: maps: UAF of mtd_info and I/O memory on device unregistration
> --
>
> commit ad3016fe3893b23f61acf9f96913ff51726ac3a0
> Author: Stephen Bancroft <stevereaver@xxxxxxxxx>
>
> mtd: maps: add INT0800 firmware-flash map driver
>
> Add a read-only mapping driver that binds the ACPI INT0800 "Intel
> 82802 firmware hub" device and exposes the system firmware flash as an
> MTD ROM device.
>
> > diff --git a/drivers/mtd/maps/int0800.c b/drivers/mtd/maps/int0800.c
> > new file mode 100644
> > index 0000000000000..c5f108aa34797
> > --- /dev/null
> > +++ b/drivers/mtd/maps/int0800.c
>
> [ ... ]
>
> > +static void int0800_remove(struct platform_device *pdev)
> > +{
> > +     struct int0800 *fw = platform_get_drvdata(pdev);
> > +
> > +     mtd_device_unregister(fw->mtd);
> > +     map_destroy(fw->mtd);
>
> [Severity: High]
> Does this teardown path force a use-after-free if the device is removed
> while a file descriptor is open?
>
> While the driver sets .suppress_bind_attrs = true to prevent manual sysfs
> unbinds, the driver core can still invoke remove() when the underlying
> device is unregistered. This can happen if root unbinds the parent bridge
> in sysfs, or via ACPI SSDT unloading.
>
> If int0800_remove() is invoked while userspace holds an open file
> descriptor, mtd_device_unregister() puts the kref but does not release
> the struct device because the character device retains an active reference.
>
> Unconditionally calling map_destroy(fw->mtd) then frees the mtd_info
> structure. Could subsequent /dev/mtd0 reads or sysfs accesses dereference
> this freed memory and access unmapped devm I/O memory?
>
> > +}
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260923092626.873202-1-stevereaver@xxxxxxxxx?part=1



-- 
Steve Reaver
http://www.stevereaver.com/
Electronic Music Production