[PATCH 2/2] software node: fix primary software node removal

[Johan Hovold <johan@kernel.org>]

When removing a software node using device_remove_software_node(), the
primary fwnode pointer is never cleared if the software node is the
primary node.

Since commit 7d80509ff0da ("driver core: platform: unify release path")
this can lead to a use-after-free when freeing a platform device if a
driver or subsystem (e.g. mfd) has already removed and freed the node.

Clear the primary fwnode pointer when removing a software node that is
the primary node to avoid this.

Fixes: 7d80509ff0da ("driver core: platform: unify release path")
Cc: stable@vger.kernel.org	# 7.3
Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/base/swnode.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 84a77ffa3dc4..9c98234979ec 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1110,7 +1110,11 @@ void device_remove_software_node(struct device *dev)
 	if (device_is_registered(dev))
 		software_node_notify_remove(dev);
 
-	set_secondary_fwnode(dev, NULL);
+	if (is_software_node(dev_fwnode(dev)))
+		set_primary_fwnode(dev, NULL);
+	else
+		set_secondary_fwnode(dev, NULL);
+
 	swnode_put(swnode);
 }
 EXPORT_SYMBOL_GPL(device_remove_software_node);
-- 
2.55.0