From: Wolfram Sang <wsa+renesas@sang-engineering.com>
To: Hans de Goede <hansg@kernel.org>
Cc: Wolfram Sang <wsa@kernel.org>, Andy Shevchenko <andy@kernel.org>,
linux-i2c@vger.kernel.org,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
stable@vger.kernel.org
Subject: Re: [PATCH] i2c: core: Fix double-free of fwnode in i2c_unregister_device()
Date: Mon, 28 Jul 2025 10:41:23 +0200 [thread overview]
Message-ID: <aIc3swA0sndwkdML@shikoro> (raw)
In-Reply-To: <20250719180104.66939-1-hansg@kernel.org>
[-- Attachment #1: Type: text/plain, Size: 729 bytes --]
On Sat, Jul 19, 2025 at 08:01:04PM +0200, Hans de Goede wrote:
> Before commit df6d7277e552 ("i2c: core: Do not dereference fwnode in struct
> device"), i2c_unregister_device() only called fwnode_handle_put() on
> of_node-s in the form of calling of_node_put(client->dev.of_node).
>
> But after this commit the i2c_client's fwnode now unconditionally gets
> fwnode_handle_put() on it.
>
> When the i2c_client has no primary (ACPI / OF) fwnode but it does have
> a software fwnode, the software-node will be the primary node and
> fwnode_handle_put() will put() it.
>
> But for the software fwnode device_remove_software_node() will also put()
> it leading to a double free:
>
Applied to for-next, thanks!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
prev parent reply other threads:[~2025-07-28 8:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-19 18:01 [PATCH] i2c: core: Fix double-free of fwnode in i2c_unregister_device() Hans de Goede
2025-07-23 14:33 ` Andy Shevchenko
2025-07-28 8:41 ` Wolfram Sang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aIc3swA0sndwkdML@shikoro \
--to=wsa+renesas@sang-engineering.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=andy@kernel.org \
--cc=hansg@kernel.org \
--cc=linux-i2c@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=wsa@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.