[PATCH v10 10/10] PCI: of: Guard against node removal with incorrect np->data

[Herve Codina <herve.codina@bootlin.com>]

of_pci_remove_node() and of_pci_remove_host_bridge_node() check
whether the node is dynamic but not whether it has valid private data.

During the node creation, an OF changeset is used and this changeset is
stored in np->data to be available for removal functions.

If, for instance, a PCI host bridge is created using a device-tree
overlay, the related node will have the dynamic flag set but np->data
will be NULL. This leads to NULL pointer dereferences.

Further more, having a NULL np->data pointer means that the node has
been created out of our PCI node creation process and so shouldn't be
handled by our PCI node removal process.

Add a np->data check for NULL to bail out early of PCI node removal
functions.

Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Fixes: 1f340724419e ("PCI: of: Create device tree PCI host bridge node")
Cc: <stable+noautosel@kernel.org> # Not triggered but 'This could be a problem...'
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
---
 drivers/pci/of.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index 28896f748e8d..9f35e1e07cdc 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -654,7 +654,7 @@ void of_pci_remove_node(struct pci_dev *pdev)
 	struct device_node *np;
 
 	np = pci_device_to_OF_node(pdev);
-	if (!np || !of_node_check_flag(np, OF_DYNAMIC))
+	if (!np || !of_node_check_flag(np, OF_DYNAMIC) || !np->data)
 		return;
 
 	fw_devlink_set_device(&np->fwnode, NULL);
@@ -750,7 +750,7 @@ void of_pci_remove_host_bridge_node(struct pci_host_bridge *bridge)
 	struct device_node *np;
 
 	np = pci_bus_to_OF_node(bridge->bus);
-	if (!np || !of_node_check_flag(np, OF_DYNAMIC))
+	if (!np || !of_node_check_flag(np, OF_DYNAMIC) || !np->data)
 		return;
 
 	fw_devlink_set_device(&np->fwnode, NULL);
-- 
2.55.0