Re: [PATCH net v2 11/14] net: pse-pd: unwind allocations when controller registration fails

[Oleksij Rempel]

On Tue, Oct 20, 2026 at 07:12:46PM +0200, Carlo Szelinsky wrote:
> When pse_controller_register() fails, it does not free the
> notification kfifo. Worse, if pse_register_pw_ds() fails part way, the
> power domains it already set up stay in the global map. Their supply
> handle belongs to a PI regulator that devres then frees, so the next
> user of the map reads freed memory.
> 
> Free the kfifo on every error path, and let pse_register_pw_ds() undo
> its own power domains while it still holds pse_pw_d_mutex, so no other
> controller can pick one up first. The PI array is already freed by
> devres.
> 
> Found by code inspection and AI review. Triggered in QEMU (arm64,
> KASAN) with a test-only PSE controller and an injected failure in
> pse_register_pw_ds() at the third PI: reading the regulator summary in
> debugfs then gives
> 
>   BUG: KASAN: slab-use-after-free in regulator_summary_show_subtree+0x770/0x9c4
> 
> With this patch the failure is undone, and kmemleak reports nothing.
> 
> Fixes: 50f8b341d268 ("net: pse-pd: Add support for PSE power domains")
> Fixes: ffef61d6d273 ("net: pse-pd: Add support for budget evaluation strategies")
> Signed-off-by: Carlo Szelinsky <github@xxxxxxxxxxxx>

Besides the pse_pi_power_off() call (see my reply to patch 10), two
small things for the next version.

Helpers that expect pse_pw_d_mutex to be held should check it with
lockdep_assert_held(), not only say so in a comment: please add it to
pse_pw_d_release_locked() here, and to pse_pw_d_leave() in patch 12.

Once patch 12 removes __pse_pw_d_release(), only one release function
is left, so the _locked suffix has nothing to tell apart. Please
rename pse_pw_d_release_locked() to pse_pw_d_release() in patch 12 and
keep the assert.

pw-bot: cr
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |