Re: [PATCH RFC v7 1/8] mfd: ls2kbmc: Make a copy when parsing mode string

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver modifies a static global `mfd_cell` array during probe, violating MFD guidelines and causing data races with potential stack Use-After-Free.
--

--- Patch [1]: [PATCH RFC v7 1/8] mfd: ls2kbmc: Make a copy when parsing mode string ---
commit 391ef025b41aeef2d29d627c04ca398a1673da60
Author: Miao Wang <[email protected]>

mfd: ls2kbmc: Make a copy when parsing mode string
    
When parsing the mode string from BMC, the string is manipulated
in-place with strsep(), preventing from parsing it again. Make a copy of
the original string and manipulate the copy instead to fix this.

> diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
> index 408056bfb2fe7..335590392240b 100644
> --- a/drivers/mfd/ls2k-bmc-core.c
> +++ b/drivers/mfd/ls2k-bmc-core.c
> @@ -427,34 +427,67 @@ static int ls2k_bmc_init(struct ls2k_bmc_ddata *ddata)
[ ... ]
>  static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
>  {
>  	struct simplefb_platform_data pd;
>  	struct ls2k_bmc_ddata *ddata;
[ ... ]
>  	ret = ls2k_bmc_parse_mode(dev, &pd);
>  	if (ret)
>  		return ret;
>  
>  	ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = &pd;
>  	ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(pd);

[Severity: High]
This isn't a bug introduced by this patch, but does modifying the global 
ls2k_bmc_cells array with a pointer to the local stack variable pd cause a 
data race?

If multiple PCI devices probe concurrently, one thread could overwrite 
ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data with a pointer to its stack.

This might result in another thread's devm_mfd_add_devices() call 
dereferencing a dangling pointer to a destroyed stack frame during its 
kmemdup() operation.

Could we avoid this by not dynamically modifying the static mfd_cell array 
during probe?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1