Re: [PATCH] drm/xe/i2c: Fix use-after-free on driver unload

["Kumar G, Naresh" <naresh.kumar.g@intel.com>]

On 10/27/2026 6:19 PM, Andi Shyti wrote:
> Hi Naresh,
>
>> @@ -1198,6 +1199,16 @@ void software_node_notify_remove(struct device *dev)
>>          sysfs_remove_link(&swnode->kobj, dev_name(dev));
>>          sysfs_remove_link(&dev->kobj, "software_node");
>>
>> +       /*
>> +        * A managed node can end up mirrored onto more than one device (e.g.
>> +        * a bus core copying the fwnode onto a child device, as i2c-core does
>> +        * for an adapter's own struct device). Only the device that actually
>> +        * owns the fwnode releases the creation reference and detaches it;
>> +        * every other device only releases the reference software_node_notify()
>> +        * took for it.
>> +        */
>> +       owns_managed_fwnode = swnode->managed && swnode->fwnode.dev == dev;
> at this point fwnode.dev is NULL, set from device_del()
>
> Andi
>
yes correct, device_del() clears fwnode.dev for the primary fwnode 
before calling software_node_notify_remove()