On 4/22/25 4:56 PM, Kory Maincent wrote: > +/** > + * pse_control_find_phy_by_id - Find PHY attached to the pse control id > + * @pcdev: a pointer to the PSE > + * @id: index of the PSE control > + * > + * Return: PHY device pointer or NULL > + */ > +static struct phy_device * > +pse_control_find_phy_by_id(struct pse_controller_dev *pcdev, int id) > +{ > + struct pse_control *psec; > + > + mutex_lock(&pse_list_mutex); > + list_for_each_entry(psec, &pcdev->pse_control_head, list) { > + if (psec->id == id) { > + mutex_unlock(&pse_list_mutex); AFAICS at this point 'psec' could be freed and the next statement could cause UaF. It looks like you should acquire a reference to the pse control? /P