Re: [PATCH v8 4/5] driver core: platform: unify release path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Dereferencing a freed primary software node during platform device release, leading to a Use-After-Free and possible double-put.
--

--- Patch [4]: [PATCH v8 4/5] driver core: platform: unify release path ---
commit a4c9de720c7986b23ccb07ee951d4a99f15666ec
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

driver core: platform: unify release path

With no drivers that manually assign software nodes to platform devices
created with platform_device_alloc(), we can now unify the release path
and remove platform_device_release_full().

> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index fb57d487a6c2a..66f9ec73d47e9 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c

[ ... ]

> @@ -599,19 +599,19 @@ static void platform_device_release(struct device *dev)
>  	struct platform_object *pa = container_of(dev, struct platform_object,
>  						  pdev.dev);
>  
> -	fwnode_handle_put(pa->pdev.dev.fwnode);
> +	device_remove_software_node(dev);
> +	/*
> +	 * If the primary firmware node is a software node, its reference count
> +	 * was already decreased by the call to device_remove_software_node().
> +	 */
> +	if (!is_software_node(dev_fwnode(dev)))

[Severity: High]
Does this check result in a use-after-free of the primary software node?

If a platform device is registered with a primary software node (for example
via platform_device_register_full()), dev->fwnode points to it.

During device release, device_remove_software_node() retrieves the primary
software node and drops the reference, potentially freeing the node:

device_remove_software_node()
   swnode_put(swnode);

Because dev->fwnode is primary, set_secondary_fwnode(dev, NULL) inside
device_remove_software_node() only clears the secondary pointer, leaving
dev->fwnode still pointing to the freed primary node.

The subsequent call to is_software_node(dev_fwnode(dev)) would then
dereference this dangling pointer.

> +		fwnode_handle_put(pa->pdev.dev.fwnode);
>  	kfree(pa->pdev.dev.platform_data);
>  	kfree(pa->pdev.mfd_cell);
>  	kfree(pa->pdev.resource);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716-swnode-remove-on-dev-unreg-v8-0-5c2b8cc38c28@oss.qualcomm.com?part=4