[PATCH] ACPI: PCI: link: clear driver_data before free

[PATCH] ACPI: PCI: link: clear driver_data before free

[Jiale Yao]

acpi_pci_link_remove() frees the link object without clearing the ACPI
device's driver_data pointer. The ACPI device survives hot-removal and
can later be retrieved by acpi_fetch_acpi_dev(), leaving callers with a
dangling pointer.

Clear driver_data before freeing the link.

Fixes: db89b4f0dbab ("ACPI: catch calls of acpi_driver_data on pointer of wrong type")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/acpi/pci_link.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index e6ed13aee48d..84bfcdf242dd 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -787,6 +787,7 @@ static void acpi_pci_link_remove(struct acpi_device *device)
 	list_del(&link->list);
 	mutex_unlock(&acpi_link_lock);
 
+	device->driver_data = NULL;
 	kfree(link);
 }
 
-- 
2.34.1

Re: [PATCH] ACPI: PCI: link: clear driver_data before free

[sashiko-bot]

> acpi_pci_link_remove() frees the link object without clearing the ACPI
> device's driver_data pointer. The ACPI device survives hot-removal and
> can later be retrieved by acpi_fetch_acpi_dev(), leaving callers with a
> dangling pointer.
> 
> Clear driver_data before freeing the link.
> 
> Fixes: db89b4f0dbab ("ACPI: catch calls of acpi_driver_data on pointer of wrong type")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925155846.2381956-1-yaojiale02@163.com?part=1

Re: [PATCH] ACPI: PCI: link: clear driver_data before free

[Rafael J. Wysocki (Intel)]

On Fri, Sep 25, 2026 at 5:59 PM Jiale Yao <yaojiale02@163.com> wrote:
>
> acpi_pci_link_remove() frees the link object without clearing the ACPI
> device's driver_data pointer. The ACPI device survives hot-removal and
> can later be retrieved by acpi_fetch_acpi_dev(), leaving callers with a
> dangling pointer.
>
> Clear driver_data before freeing the link.
>
> Fixes: db89b4f0dbab ("ACPI: catch calls of acpi_driver_data on pointer of wrong type")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/acpi/pci_link.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
> index e6ed13aee48d..84bfcdf242dd 100644
> --- a/drivers/acpi/pci_link.c
> +++ b/drivers/acpi/pci_link.c
> @@ -787,6 +787,7 @@ static void acpi_pci_link_remove(struct acpi_device *device)
>         list_del(&link->list);
>         mutex_unlock(&acpi_link_lock);
>
> +       device->driver_data = NULL;
>         kfree(link);
>  }
>
> --

Applied as 7.4 material, thanks!