CVE-2026-89744: device property: fix infinite loop in fwnode_for_each_child_node()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an infinite loop if the secondary
fwnode has more than one child.

                       Parent        Child
      (Primary fwnode)   FWa:   {FWa1, FWa2, FWa3}
    (Secondary fwnode)   FWb:   {FWb1, FWb2}

In this case:

 ┌─> fwnode_get_next_child_node(FWa, FWa1)
 │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2
 │
 │   ...
 │
 │   fwnode_get_next_child_node(FWa, FWa3)
 │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL
 │    - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1
 │
 │   fwnode_get_next_child_node(FWa, FWb1)
 │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1
 └────┘

This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly
output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.

The root cause is that when the current child (FWb1) belongs to the
secondary fwnode, calling get_next_child_node() on the parimary fwnode
incorrectly returns the first child (FWa1) again instead of NULL.

Fix this by dynamically checking the parent fwnode of the current child
before calling get_next_child_node(). This approach follows the pattern
established in commit b5b41ab6b0c1 ("device property: Check
fwnode->secondary in fwnode_graph_get_next_endpoint()").

The Linux kernel CVE team has assigned CVE-2026-89744 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12.78 with commit 64dc258f9eec1d7204e9879cb836fe29967f1239 and fixed in 6.12.109 with commit 20ed517e416df89448029293304c9e180c26cd4b
	Issue introduced in 6.18.19 with commit 32752c3e81498b106da64a141379eb94f493fe6f and fixed in 6.18.50 with commit ba69d892ff4e4a58cc12a2cae106b112db3306cc
	Issue introduced in 7.0 with commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 and fixed in 7.2.4 with commit 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6
	Issue introduced in 7.0 with commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 and fixed in 7.3-rc1 with commit 1900692555826753adab8799a1a8d50bb1ee200c
	Issue introduced in 5.10.253 with commit d1370a4f2aa0d811d419f6a6c6d257867d608956
	Issue introduced in 5.15.203 with commit 5b51b2ba5207e07bcd7be0daab2f8eea405e005e
	Issue introduced in 6.1.167 with commit 272fcf19fda14ec603ce915aafc56cb3ea2fb38d
	Issue introduced in 6.6.130 with commit 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6
	Issue introduced in 6.19.9 with commit 43a621684ffa47fc008be98b15ff7becaf3a72fa

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89744
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/base/property.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b
	https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc
	https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6
	https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c