[PATCH 0/2] peci: Fix two use-after-free bugs in device teardown

[Suyuan Wang]

Hi,

A static analysis run over the PECI core turned up two places where a
struct device is still used after the reference keeping it alive may
be gone. I went through both by hand on next-20261109.

The first one is in unregister_controller(), which reads the fwnode
and disables runtime PM after device_unregister() has normally already
freed the controller. The second one is in the sysfs "remove" handler:
it doesn't hold a reference across device_remove_file_self() and
peci_device_destroy(), so the device can be freed under it, either by
its own device_unregister() or by a controller removal running at the
same time. For that one I followed what SCSI does in
sdev_store_delete().

Both are compile tested only, since I don't have PECI hardware. If
anyone with an AST2600 or NPCM BMC could give them a quick run, that
would be great.

Thanks,
Suyuan

Suyuan Wang (2):
  peci: Fix use-after-free in unregister_controller()
  peci: Fix use-after-free in remove_store()

 drivers/peci/core.c  |  8 +++++---
 drivers/peci/sysfs.c | 13 ++++++++++++-
 2 files changed, 17 insertions(+), 4 deletions(-)


base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.34.1