Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Switching to the generic PAS API breaks the hard module dependency on the PAS backend driver, exposing a TOCTOU and Use-After-Free race condition against backend module unloading. --
commit 6d60b150886ed8cbb76a8f5f11bec8a93730899c Author: Sumit Garg <[email protected]> Subject: net: ipa: Switch to generic PAS TZ APIs This commit switches the IPA client driver to use the generic PAS TZ APIs. The change allows the driver to support multiple TrustZone implementation backends rather than being tied specifically to the QTEE based SCM PAS service. > diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c > --- a/drivers/net/ipa/ipa_main.c > +++ b/drivers/net/ipa/ipa_main.c > @@ -624,10 +624,13 @@ static int ipa_firmware_load(struct device *dev) > } > > ret = qcom_mdt_load(dev, fw, path, IPA_PAS_ID, virt, phys, size, NULL); > - if (ret) > + if (ret) { > dev_err(dev, "error %d loading \"%s\"\n", ret, path); > - else if ((ret = qcom_scm_pas_auth_and_reset(IPA_PAS_ID))) > - dev_err(dev, "error %d authenticating \"%s\"\n", ret, path); > + } else { > + ret = qcom_pas_auth_and_reset(IPA_PAS_ID); [Severity: High] Does switching to the generic PAS API here break the hard module dependency on the PAS backend driver? By removing the direct symbol dependency on qcom_scm, it appears the backend PAS module can now be concurrently unloaded. If the backend is unloaded during this call, could it cause a use-after-free or NULL pointer dereference? For example: 1. ipa_firmware_load() calls qcom_pas_auth_and_reset(). 2. qcom_pas_auth_and_reset() checks if (!ops_ptr). 3. The backend PAS module is concurrently unloaded, and qcom_pas_ops_unregister() clears ops_ptr and frees the module memory. 4. qcom_pas_auth_and_reset() dereferences the now-freed ops_ptr memory. Before this patch, the direct symbol call to qcom_scm_pas_auth_and_reset() forced a strict module dependency that prevented backend removal. > + if (ret) > + dev_err(dev, "error %d authenticating \"%s\"\n", ret, > path); > + } > > memunmap(virt); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=11
