From: Johan Hovold <johan@kernel.org>
To: Guangshuo Li <lgs201920130244@gmail.com>
Cc: Bin Liu <b-liu@ti.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Wentao Liang <vulab@iscas.ac.cn>,
linux-usb@vger.kernel.org, linux-omap@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe
Date: Mon, 6 Jul 2026 09:07:17 +0200 [thread overview]
Message-ID: <aktUJSxhLBtlWoFF@hovoldconsulting.com> (raw)
In-Reply-To: <20260705091411.282560-1-lgs201920130244@gmail.com>
On Sun, Jul 05, 2026 at 05:14:11PM +0800, Guangshuo Li wrote:
> omap2430_probe() stores pdev->dev.of_node in a local np variable. This is
> a borrowed pointer and the probe function does not take a reference to
> it.
>
> The success and error paths nevertheless call of_node_put(np). This drops
> a reference that is owned by the platform device, and can leave
> pdev->dev.of_node with an unbalanced reference count.
>
> Do not put the borrowed platform device node from omap2430_probe().
> References taken for the child MUSB device are handled by the device core,
> and the ctrl-module phandle reference is still released separately.
>
> Fixes: e194ce048f5a ("usb: musb: omap2430: Fix use-after-free in omap2430_probe()")
This was not the commit that introduced the issue. This should be:
Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources")
and this should be backported to stable as well:
Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
And again, how are you finding these issues? Still no LLM involved?
With the above fixed:
Reviewed-by: Johan Hovold <johan@kernel.org>
Johan
next prev parent reply other threads:[~2026-07-06 7:07 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-05 9:14 [PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe Guangshuo Li
2026-07-06 7:07 ` Johan Hovold [this message]
2026-07-13 11:48 ` Guangshuo Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aktUJSxhLBtlWoFF@hovoldconsulting.com \
--to=johan@kernel.org \
--cc=b-liu@ti.com \
--cc=gregkh@linuxfoundation.org \
--cc=lgs201920130244@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-omap@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=vulab@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.