Re: [PATCH net v2 07/14] net: pse-pd: do not tie a shared power domain to its creator's devres

[Oleksij Rempel]

On Tue, Oct 20, 2026 at 07:12:42PM +0200, Carlo Szelinsky wrote:
> A power domain is shared by all controllers on the same supply and
> counted with a kref, but it is devm memory of the controller that
> created it. When that controller unbinds while another one still uses
> the domain, devres frees it anyway, and the other controller and the
> global map keep pointing at freed memory. The same happens when
> pse_register_pw_ds() fails part way.
> 
> Allocate the domain with kzalloc() and free it on its last kref_put().
> A domain left over from a failed pse_register_pw_ds() is now leaked
> instead of freed while still in the map.
> 
> Because the domain can now be freed at the put, pse_flush_pw_ds() clears
> pi[].pw_d under pcdev->lock before the put, and pse_ethtool_set_prio()
> checks it under that lock. The PI regulator ops and pse_isr() use it
> under the same lock.
> 
> Triggered in QEMU (arm64, KASAN) with two test-only PSE controllers
> on one supply: after the one that created the domain unbinds, binding
> it again gives
> 
>   BUG: KASAN: slab-use-after-free in pse_controller_register+0xb98/0x1274
> 
> With this patch it is gone.
> 
> Fixes: 50f8b341d268 ("net: pse-pd: Add support for PSE power domains")
> Signed-off-by: Carlo Szelinsky <github@xxxxxxxxxxxx>

The power domain lifetime changes in 7 and 10-12 build on each
other; if there is another round, folding them into fewer patches
would make them easier to review.

Acked-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx>

Thank you!
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |