On 4/22/25 4:56 PM, Kory Maincent wrote:
> +/**
> + * pse_control_find_phy_by_id - Find PHY attached to the pse control id
> + * @pcdev: a pointer to the PSE
> + * @id: index of the PSE control
> + *
> + * Return: PHY device pointer or NULL
> + */
> +static struct phy_device *
> +pse_control_find_phy_by_id(struct pse_controller_dev *pcdev, int id)
> +{
> + struct pse_control *psec;
> +
> + mutex_lock(&pse_list_mutex);
> + list_for_each_entry(psec, &pcdev->pse_control_head, list) {
> + if (psec->id == id) {
> + mutex_unlock(&pse_list_mutex);
AFAICS at this point 'psec' could be freed and the next statement could
cause UaF.
It looks like you should acquire a reference to the pse control?
/P
