[PATCH 0/2] driver core: platform: fix sw node use-after-free on device release

[PATCH 0/2] driver core: platform: fix sw node use-after-free on device release

[Johan Hovold]

Sashiko noted a new use-after-free issue when freeing platform device
which has a software node as its primary fw node.

Turns out that can cause trouble also when drivers or subsystems remove
software nodes themselves.

Johan


Johan Hovold (2):
  driver core: platform: fix sw node use-after-free on device release
  software node: fix primary software node removal

 drivers/base/platform.c | 3 ++-
 drivers/base/swnode.c   | 6 +++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

-- 
2.55.0

[PATCH 1/2] driver core: platform: fix sw node use-after-free on device release

[Johan Hovold]

When a device has a software node, device_remove_software_node() may
drop the last reference and free it during platform_device_release().
And if the software node is the primary node then the device fwnode
pointer is currently never cleared.

Use a temporary variable to track whether the primary node is a software
node to avoid a use-after-free in is_software_node() and having
fwnode_handle_put() call a function pointer via poisoned or reallocated
memory when the primary node is a software node.

This issue was flagged by Sashiko when reviewing a related fix.

Fixes: 7d80509ff0da ("driver core: platform: unify release path")
Closes: https://sashiko.dev/#/bug/linux-b860000b-f1d0-46a0-ab52-d47cec8eab99
Cc: stable@vger.kernel.org	# 7.3
Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/base/platform.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 979593e5cca1..ef0bfa972653 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -598,13 +598,14 @@ static void platform_device_release(struct device *dev)
 {
 	struct platform_object *pa = container_of(dev, struct platform_object,
 						  pdev.dev);
+	bool primary_is_software_node = is_software_node(dev_fwnode(dev));
 
 	device_remove_software_node(dev);
 	/*
 	 * If the primary firmware node is a software node, its reference count
 	 * was already decreased by the call to device_remove_software_node().
 	 */
-	if (!is_software_node(dev_fwnode(dev)))
+	if (!primary_is_software_node)
 		fwnode_handle_put(pa->pdev.dev.fwnode);
 	kfree(pa->pdev.dev.platform_data);
 	kfree(pa->pdev.mfd_cell);
-- 
2.55.0

[PATCH 2/2] software node: fix primary software node removal

[Johan Hovold]

When removing a software node using device_remove_software_node(), the
primary fwnode pointer is never cleared if the software node is the
primary node.

Since commit 7d80509ff0da ("driver core: platform: unify release path")
this can lead to a use-after-free when freeing a platform device if a
driver or subsystem (e.g. mfd) has already removed and freed the node.

Clear the primary fwnode pointer when removing a software node that is
the primary node to avoid this.

Fixes: 7d80509ff0da ("driver core: platform: unify release path")
Cc: stable@vger.kernel.org	# 7.3
Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/base/swnode.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 84a77ffa3dc4..9c98234979ec 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1110,7 +1110,11 @@ void device_remove_software_node(struct device *dev)
 	if (device_is_registered(dev))
 		software_node_notify_remove(dev);
 
-	set_secondary_fwnode(dev, NULL);
+	if (is_software_node(dev_fwnode(dev)))
+		set_primary_fwnode(dev, NULL);
+	else
+		set_secondary_fwnode(dev, NULL);
+
 	swnode_put(swnode);
 }
 EXPORT_SYMBOL_GPL(device_remove_software_node);
-- 
2.55.0

Re: [PATCH 1/2] driver core: platform: fix sw node use-after-free on device release

[Bartosz Golaszewski]

On Mon, Nov 02, 2026 at 12:14:19PM +0100, Johan Hovold wrote:
> When a device has a software node, device_remove_software_node() may
> drop the last reference and free it during platform_device_release().
> And if the software node is the primary node then the device fwnode
> pointer is currently never cleared.
> 
> Use a temporary variable to track whether the primary node is a software
> node to avoid a use-after-free in is_software_node() and having
> fwnode_handle_put() call a function pointer via poisoned or reallocated
> memory when the primary node is a software node.
> 
> This issue was flagged by Sashiko when reviewing a related fix.
> 
> Fixes: 7d80509ff0da ("driver core: platform: unify release path")
> Closes: https://sashiko.dev/#/bug/linux-b860000b-f1d0-46a0-ab52-d47cec8eab99
> Cc: stable@vger.kernel.org	# 7.3
> Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Re: [PATCH 2/2] software node: fix primary software node removal

[Johan Hovold]

On Mon, Nov 02, 2026 at 12:14:20PM +0100, Johan Hovold wrote:
> When removing a software node using device_remove_software_node(), the
> primary fwnode pointer is never cleared if the software node is the
> primary node.
> 
> Since commit 7d80509ff0da ("driver core: platform: unify release path")
> this can lead to a use-after-free when freeing a platform device if a
> driver or subsystem (e.g. mfd) has already removed and freed the node.
> 
> Clear the primary fwnode pointer when removing a software node that is
> the primary node to avoid this.
> 
> Fixes: 7d80509ff0da ("driver core: platform: unify release path")
> Cc: stable@vger.kernel.org	# 7.3
> Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko had some comments on this one, will revisit.

The first patch could go in meanwhile.

Johan