Re: [PATCH v1 08/11] leds: st1202: Take a reference on the LED firmware node

[sashiko-bot@kernel.org]

> st1202_dt_init() stores each LED's firmware node while walking the
> device tree with for_each_available_child_of_node_scoped(), which drops
> its reference to the node at the end of every iteration. The stored
> pointer is not used until st1202_probe() registers the LED class devices
> in a separate loop, by which point the driver holds no reference to the
> node at all.
> 
> With CONFIG_OF_DYNAMIC the node can be freed in between, leaving
> led->fwnode dangling and causing a use-after-free when it is handed to
> devm_led_classdev_register_ext(). The LED class stores the pointer with
> device_set_node() and does not take a reference of its own, so the node
> has to stay alive for as long as the LED device does.
> 
> Take a reference when the node is stored and release it through a devm
> action. The action is registered before the LED class devices are, so it
> runs after they have been unregistered.
> 
> Fixes: c72e455b89f2 ("leds: leds-st1202: Fix NULL pointer access on race condition")
> Signed-off-by: Manuel Fombuena <fombuena@outlook.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/GV1PR08MB8497422B7A44424C4968AEC1C5BD2@GV1PR08MB8497.eurprd08.prod.outlook.com?part=8