Re: [PATCH net-next v8 3/7] net: pse-pd: unwind allocations when controller registration fails

[Carlo Szelinsky]

On Mon, 05 Oct 2026 17:33:27 +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> [Severity: Medium]
> Is this store enough to keep pse_pi_is_enabled() away from a freed pw_d?
> The store is done without pcdev->lock, but the reader holds that lock:
...
> Would it close this window to take pcdev->lock around the pointer clear
> and do the kref_put_mutex() calls afterwards, outside pcdev->lock?

Yes, agreed. In v9 pi[].pw_d is cleared under pcdev->lock, and the
reference is dropped afterwards, outside that lock.

> [Severity: High]
> This is a pre-existing issue and was not introduced by this patch, but
> this patch reworks the kfifo handling here. Can the kfifo ever be
> allocated for podl-pse-regulator?

No, it can't, so podl-pse-regulator never registers today. That is an
older bug; its fix goes to net.

> [Severity: Medium]
> Doesn't this still leak pcdev->pi and the OF references on the PI and
> pairset nodes?
...
> A devm action on pcdev->dev that releases the PIs could be added right
> after of_load_pse_pis() succeeds.

Yes, the PI array is still leaked once the PI regulators exist, and the
commit message says so. The devm action is a good idea, but it also
changes how unregister frees the array, so I'd rather do it as a
separate follow-up than in this series.

> [Severity: High]
> Can a controller probing at the same time still hit the use-after-free
> the commit message describes?
...
> Could pse_register_pw_ds() undo those domains
> itself before the out: label, doing kref_put/xa_erase/regulator_put while
> it still holds pse_pw_d_mutex?

Yes, agreed. v9 does exactly that: pse_register_pw_ds() undoes its own
domains while it still holds pse_pw_d_mutex.

> [Severity: Low]
> Should this patch carry Fixes: tags and a stable Cc?
...
> Could this also go to net on its own, rather than sit inside the
> notifier chain / phylib ownership series?

v9 moves this patch out of the notifier series, into the separate PSE
core fixes series. That series goes to net-next, because the notifier
series builds on it. The older bugs it touches that also hurt on their
own, the kfifo size and the shared power domain, go to net with Fixes:
tags.

Carlo